Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.lnk
Modifies file system
Creates the following files
- %TEMP%\_mei00000f942\vcruntime140.dll
- %TEMP%\_mei00000f942\_asyncio.pyd
- %TEMP%\_mei00000f942\_bz2.pyd
- %TEMP%\_mei00000f942\_ctypes.pyd
- %TEMP%\_mei00000f942\_decimal.pyd
- %TEMP%\_mei00000f942\_hashlib.pyd
- %TEMP%\_mei00000f942\_lzma.pyd
- %TEMP%\_mei00000f942\_multiprocessing.pyd
- %TEMP%\_mei00000f942\_overlapped.pyd
- %TEMP%\_mei00000f942\_queue.pyd
- %TEMP%\_mei00000f942\_socket.pyd
- %TEMP%\_mei00000f942\_ssl.pyd
- %TEMP%\_mei00000f942\base_library.zip
- %TEMP%\_mei00000f942\certifi\cacert.pem
- %TEMP%\_mei00000f942\charset_normalizer\cd.cp311-win_amd64.pyd
- %TEMP%\_mei00000f942\charset_normalizer\md.cp311-win_amd64.pyd
- %TEMP%\_mei00000f942\libcrypto-1_1.dll
- %TEMP%\_mei00000f942\libffi-8.dll
- %TEMP%\_mei00000f942\libssl-1_1.dll
- %TEMP%\_mei00000f942\pyexpat.pyd
- %TEMP%\_mei00000f942\python311.dll
- %TEMP%\_mei00000f942\select.pyd
- %TEMP%\_mei00000f942\unicodedata.pyd
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command " $ws = New-Object -ComObject WScript.Shell $s = $ws.CreateShortcut(\"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\<File name>.lnk\") $s.TargetPath = ...
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
