Technical Information
Malicious functions
Injects code into
the following user processes:
- msedge.exe
Modifies file system
Creates the following files
- %TEMP%\pkg\325cf7f939407041d15c7a39c6025aa49eee66521970a8063b4593812a0c8d00\chrome_elevator.node
- nul
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"' (with hidden window)
