Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mls' = '"%APPDATA%\RAC\mls.exe" -s'
Creates the following files on removable media
- %TEMP%\237384764.tmp
- <Drive name for removable media>:\weeklysheet1215.exe
Modifies file system
Creates the following files
- %TEMP%\27644748.tmp
- %TEMP%\rcxa2ce.tmp
- %TEMP%\rcxa35c.tmp
- <PATH_SAMPLE>.xlsx
- %TEMP%\237384764.tmp
- %TEMP%\rcxb201.tmp
- %TEMP%\rcxb250.tmp
- %TEMP%\rcxb29f.tmp
- %TEMP%\232154774.tmp
Sets the 'hidden' attribute to the following files
- <PATH_SAMPLE>.xlsx
- %TEMP%\237384764.tmp
Moves the following files
- from %TEMP%\rcxa2ce.tmp to %TEMP%\27644748.tmp
- from %TEMP%\rcxa35c.tmp to %TEMP%\27644748.tmp
- from %TEMP%\27644748.tmp to %APPDATA%\rac\mls.exe
- from %TEMP%\rcxb201.tmp to %TEMP%\237384764.tmp
- from %TEMP%\rcxb250.tmp to %TEMP%\237384764.tmp
- from %TEMP%\rcxb29f.tmp to %TEMP%\237384764.tmp
Network activity
UDP
- DNS ASK wx###lytics.ru
Miscellaneous
Searches for the following windows
- ClassName: 'XLMAIN' WindowName: 'Microsoft Excel (Product Activation Failed) - Book1'
- ClassName: 'XLMAIN' WindowName: ''
Creates and executes the following
- '%APPDATA%\rac\mls.exe' -s
- '%ProgramFiles%\microsoft office\office14\excel.exe' /dde' (with hidden window)
- '%APPDATA%\rac\mls.exe' -s' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' /dde
