Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\Microsoft.exe" "Microsoft.exe" ENABLE
Modifies file system
Creates the following files
- %TEMP%\microsoft.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
Network activity
Connects to
- 'localhost':1177
Miscellaneous
Creates and executes the following
- '%TEMP%\microsoft.exe'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\Microsoft.exe" "Microsoft.exe" ENABLE' (with hidden window)
