Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\ibm-scmd-affinity
Modifies file system
Creates the following files
- <SYSTEM32>\affinityscmdtimeformat.txt
- <SYSTEM32>\<File name>.vbs.control
- <SYSTEM32>\ibm-scmd-affinity_harswlfsvpg.xml
- <SYSTEM32>\<File name>.vbs.running
- <SYSTEM32>\manual_affinity_harswlfsvpg.scmd
Deletes the following files
- <SYSTEM32>\affinityscmdtimeformat.txt
- <SYSTEM32>\ibm-scmd-affinity_harswlfsvpg.xml
- <SYSTEM32>\<File name>.vbs.running
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C schtasks /create /? > .\AffinitySCMDTIMEFORMAT.TXT' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ECHO 2020-09-28T02:48:30Z >> <SYSTEM32>\Manual_Affinity_harswlfsvpg.SCMD' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ECHO harswlfsvpg >> <SYSTEM32>\Manual_Affinity_harswlfsvpg.SCMD' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ECHO Affinity Script ver 5.6.1 >> <SYSTEM32>\Manual_Affinity_harswlfsvpg.SCMD' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C VER >> <SYSTEM32>\Manual_Affinity_harswlfsvpg.SCMD' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C @ECHO Running AFF 6.1 OSXPorBetter 6.1 9/27/2020 7:48:35 PM >> <SYSTEM32>\<File name>.vbs.running' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C IF EXIST <SYSTEM32>\IBM-SCMD-Affinity_harswlfsvpg.xml DEL <SYSTEM32>\IBM-SCMD-Affinity_harswlfsvpg.xml' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C netstat -anovb >> <SYSTEM32>\Manual_Affinity_harswlfsvpg.SCMD' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C @ECHO N|schtasks /create /XML <SYSTEM32>\IBM-SCMD-Affinity_harswlfsvpg.xml /TN IBM-SCMD-Affinity' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C @ECHO RunDays = 35 >> <SYSTEM32>\<File name>.vbs.control' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C @ECHO EndDate = 2020/11/01>> <SYSTEM32>\<File name>.vbs.control' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C @ECHO RunEveryMinutes = 16 >> <SYSTEM32>\<File name>.vbs.control' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C @ECHO SCMDMaXSizeOutFile = 100 >> <SYSTEM32>\<File name>.vbs.control' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C @ECHO SCMDOutPath = <SYSTEM32>\ >> <SYSTEM32>\<File name>.vbs.control' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C DEL .\AffinitySCMDTIMEFORMAT.TXT' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C IF EXIST <SYSTEM32>\tcpvcon.exe DEL <SYSTEM32>\tcpvcon.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C DEL <SYSTEM32>\<File name>.vbs.running' (with hidden window)
Executes the following
- '<SYSTEM32>\cscript.exe' //nologo "<PATH_SAMPLE>.vbs"
- '<SYSTEM32>\cmd.exe' /C netstat -anovb >> <SYSTEM32>\Manual_Affinity_harswlfsvpg.SCMD
- '<SYSTEM32>\cmd.exe' /C ECHO 2020-09-28T02:48:30Z >> <SYSTEM32>\Manual_Affinity_harswlfsvpg.SCMD
- '<SYSTEM32>\cmd.exe' /C ECHO harswlfsvpg >> <SYSTEM32>\Manual_Affinity_harswlfsvpg.SCMD
- '<SYSTEM32>\cmd.exe' /C ECHO Affinity Script ver 5.6.1 >> <SYSTEM32>\Manual_Affinity_harswlfsvpg.SCMD
- '<SYSTEM32>\cmd.exe' /C VER >> <SYSTEM32>\Manual_Affinity_harswlfsvpg.SCMD
- '<SYSTEM32>\cmd.exe' /C @ECHO Running AFF 6.1 OSXPorBetter 6.1 9/27/2020 7:48:35 PM >> <SYSTEM32>\<File name>.vbs.running
- '<SYSTEM32>\cmd.exe' /C IF EXIST <SYSTEM32>\IBM-SCMD-Affinity_harswlfsvpg.xml DEL <SYSTEM32>\IBM-SCMD-Affinity_harswlfsvpg.xml
- '<SYSTEM32>\schtasks.exe' /create /XML <SYSTEM32>\IBM-SCMD-Affinity_harswlfsvpg.xml /TN IBM-SCMD-Affinity
- '<SYSTEM32>\cmd.exe' /S /D /c" ECHO N"
- '<SYSTEM32>\cmd.exe' /C @ECHO N|schtasks /create /XML <SYSTEM32>\IBM-SCMD-Affinity_harswlfsvpg.xml /TN IBM-SCMD-Affinity
- '<SYSTEM32>\cmd.exe' /C IF EXIST <SYSTEM32>\tcpvcon.exe DEL <SYSTEM32>\tcpvcon.exe
- '<SYSTEM32>\cmd.exe' /C @ECHO RunDays = 35 >> <SYSTEM32>\<File name>.vbs.control
- '<SYSTEM32>\cmd.exe' /C @ECHO EndDate = 2020/11/01>> <SYSTEM32>\<File name>.vbs.control
- '<SYSTEM32>\cmd.exe' /C @ECHO RunEveryMinutes = 16 >> <SYSTEM32>\<File name>.vbs.control
- '<SYSTEM32>\cmd.exe' /C @ECHO SCMDMaXSizeOutFile = 100 >> <SYSTEM32>\<File name>.vbs.control
- '<SYSTEM32>\cmd.exe' /C @ECHO SCMDOutPath = <SYSTEM32>\ >> <SYSTEM32>\<File name>.vbs.control
- '<SYSTEM32>\cmd.exe' /C DEL .\AffinitySCMDTIMEFORMAT.TXT
- '<SYSTEM32>\schtasks.exe' /create /?
- '<SYSTEM32>\cmd.exe' /C schtasks /create /? > .\AffinitySCMDTIMEFORMAT.TXT
- '<SYSTEM32>\netstat.exe' -anovb
- '<SYSTEM32>\cmd.exe' /C DEL <SYSTEM32>\<File name>.vbs.running