Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskhost.exe' $(Arg0)
Modifies file system :
Creates the following files:
- C:\ProgramData\Microsoft\RAC\Temp\sql208B.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sql1A91.tmp
Deletes the following files:
- %WINDIR%\inf\WmiApRpl\0019\WmiApRpl.ini
- %WINDIR%\inf\WmiApRpl\WmiApRpl.h
- <SYSTEM32>\Tasks\Microsoft\Windows Defender\MP Scheduled Scan
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %WINDIR%\inf\WmiApRpl\0009\WmiApRpl.ini