Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%APPDATA%\hbm.exe'
Modifies file system
Creates the following files
- %APPDATA%\hbm.exe
- %APPDATA%\oxyhematin\didacticality\phacitis\subchela.kno
- %APPDATA%\oxyhematin\didacticality\phacitis\bttray.toolkit.dll
- %APPDATA%\oxyhematin\didacticality\phacitis\dilettantforestillingen\prangeren\frdigbehandlings.lic
- %APPDATA%\oxyhematin\didacticality\phacitis\sindssygt233\deltoges\office.dll
- %TEMP%\nsh85a.tmp\nsexec.dll
- %TEMP%\error014960_01.xml
Network activity
Connects to
- '19#.#.173.102':80
TCP
HTTP GET requests
- http://19#.#.173.102/WWL.exe
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x05 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x36 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x7E -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x62 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x7A -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x6E -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x23 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x66 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x0F -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x22 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x27 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x08 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x3A -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x2F -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x2B -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x3C -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x0D -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x74 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x7C -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x7D -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x02 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x00 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x1C -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x0B -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x76 -bxor 78' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x3E -bxor 78' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x36 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x7E -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x62 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x7A -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x6E -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x23 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x66 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x0F -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x22 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x27 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x08 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x76 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x3A -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x2B -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x3C -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x0D -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x74 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x7C -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x7D -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x02 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x00 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x1C -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x0B -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x05 -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x2F -bxor 78
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' 0x3E -bxor 78
