Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\outlook cli manager update
Modifies file system
Creates the following files
- <Current directory>\app_log.txt
- %LOCALAPPDATA%\outlook\outlookcli\dllmanager\dllmanager.exe
Network activity
TCP
Other
- '15#.#01.65.91':443
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /C wmic bios get version
- '<SYSTEM32>\wbem\wmic.exe' bios get version
- '<SYSTEM32>\cmd.exe' /C sc query VBoxGuest
- '<SYSTEM32>\sc.exe' query VBoxGuest
- '<SYSTEM32>\cmd.exe' /C sc query VBoxMouse
- '<SYSTEM32>\sc.exe' query VBoxMouse
- '<SYSTEM32>\cmd.exe' /C sc query VBoxService
- '<SYSTEM32>\sc.exe' query VBoxService
- '<SYSTEM32>\cmd.exe' /C sc query vmdebug
- '<SYSTEM32>\sc.exe' query vmdebug
- '<SYSTEM32>\cmd.exe' /C sc query vmmouse
- '<SYSTEM32>\sc.exe' query vmmouse
- '<SYSTEM32>\cmd.exe' /C sc query VMTools
- '<SYSTEM32>\sc.exe' query VMTools
- '<SYSTEM32>\cmd.exe' /C sc query Vmware Physical Disk Helper Service
- '<SYSTEM32>\sc.exe' query Vmware Physical Disk Helper Service
- '<SYSTEM32>\cmd.exe' /C tasklist
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /C wmic diskdrive get model
- '<SYSTEM32>\wbem\wmic.exe' diskdrive get model
- '<SYSTEM32>\cmd.exe' /C wmic logicaldisk where "DeviceID='C:'" get Size
- '<SYSTEM32>\wbem\wmic.exe' logicaldisk where "DeviceID='C:'" get Size
- '<SYSTEM32>\cmd.exe' /C wmic path win32_pointingdevice get name,description,manufacturer
- '<SYSTEM32>\wbem\wmic.exe' path win32_pointingdevice get name,description,manufacturer
- '<SYSTEM32>\cmd.exe' /C wmic cpu get numberofcores
- '<SYSTEM32>\wbem\wmic.exe' cpu get numberofcores
- '<SYSTEM32>\cmd.exe' /C wmic os get totalvisiblememorysize
- '<SYSTEM32>\wbem\wmic.exe' os get totalvisiblememorysize
- '<SYSTEM32>\cmd.exe' /C wmic cpu get name
- '<SYSTEM32>\wbem\wmic.exe' cpu get name
- '<SYSTEM32>\cmd.exe' /C wmic path win32_videocontroller get name
- '<SYSTEM32>\wbem\wmic.exe' path win32_videocontroller get name
- '<SYSTEM32>\cmd.exe' /C whoami
- '<SYSTEM32>\whoami.exe'
- '<SYSTEM32>\cmd.exe' /C schtasks /create /tn "Outlook CLI Manager Update" /tr "%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe" /sc ONLOGON /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Outlook CLI Manager Update" /tr "%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe" /sc ONLOGON /f
- '<SYSTEM32>\cmd.exe' /C wmic bios get version' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C sc query VBoxGuest' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C sc query VBoxMouse' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C sc query VBoxService' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C sc query vmdebug' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C sc query vmmouse' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C sc query VMTools' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C sc query Vmware Physical Disk Helper Service' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic diskdrive get model' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic logicaldisk where "DeviceID='C:'" get Size' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic path win32_pointingdevice get name,description,manufacturer' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic cpu get numberofcores' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic os get totalvisiblememorysize' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic cpu get name' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic path win32_videocontroller get name' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C whoami' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C schtasks /create /tn "Outlook CLI Manager Update" /tr "%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe" /sc ONLOGON /f' (with hidden window)
