MSIL.Cola.1

Technical Information

To ensure autorun and distribution:

Changes the following executable system files:

%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe

Infects the following executable files:

%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe

Modifies file system:

Creates the following files:

%TEMP%\lsq5rqis.0.cs
<Current directory>\CSC9.tmp
%TEMP%\RESA.tmp
<Current directory>\x90y.exe
%TEMP%\f544mfz3.0.cs
%TEMP%\f544mfz3.cmdline
%TEMP%\f544mfz3.out
<Current directory>\CSCB.tmp
%TEMP%\p11zdf2q.cmdline
%TEMP%\p11zdf2q.out
%TEMP%\RESC.tmp
%TEMP%\kmz3fusj.out
<Current directory>\CSCD.tmp
%TEMP%\RESE.tmp
<Current directory>\x1491y.exe
%TEMP%\wochqgld.0.cs
%TEMP%\wochqgld.cmdline
%TEMP%\wochqgld.out
%TEMP%\kmz3fusj.0.cs
%TEMP%\kmz3fusj.cmdline
%TEMP%\p11zdf2q.0.cs
%TEMP%\RES8.tmp
<Current directory>\CSC7.tmp
%TEMP%\lsq5rqis.out
<Current directory>\CSC1.tmp
%TEMP%\RES2.tmp
<Current directory>\x367y.exe
%TEMP%\f3akkjt5.0.cs
%TEMP%\f3akkjt5.cmdline
%TEMP%\f3akkjt5.out
<Current directory>\CSC3.tmp
%TEMP%\lsq5rqis.cmdline
%TEMP%\RES4.tmp
%TEMP%\wk3fldan.cmdline
%TEMP%\wk3fldan.out
<Current directory>\CSC5.tmp
%TEMP%\RES6.tmp
<Current directory>\x82y.exe
%TEMP%\fxiw3xa0.0.cs
%TEMP%\fxiw3xa0.cmdline
%TEMP%\fxiw3xa0.out
%TEMP%\wk3fldan.0.cs
<Current directory>\CSCF.tmp
%TEMP%\RES10.tmp

Deletes the following files:

%TEMP%\RES2.tmp
%TEMP%\RESA.tmp
<Current directory>\CSC9.tmp
%TEMP%\p11zdf2q.cmdline
%TEMP%\p11zdf2q.0.cs
%TEMP%\p11zdf2q.out
<Current directory>\x90y.exe
%TEMP%\RESC.tmp
<Current directory>\CSCB.tmp
%TEMP%\f544mfz3.out
%TEMP%\f544mfz3.cmdline
%TEMP%\f544mfz3.0.cs
%TEMP%\RESE.tmp
<Current directory>\CSCD.tmp
%TEMP%\kmz3fusj.out
%TEMP%\kmz3fusj.cmdline
%TEMP%\kmz3fusj.0.cs
<Current directory>\x1491y.exe
%TEMP%\fxiw3xa0.out
%TEMP%\RES10.tmp
%TEMP%\fxiw3xa0.0.cs
<Current directory>\CSC7.tmp
<Current directory>\CSC1.tmp
%TEMP%\lsq5rqis.cmdline
%TEMP%\lsq5rqis.out
%TEMP%\lsq5rqis.0.cs
<Current directory>\x367y.exe
%TEMP%\RES4.tmp
<Current directory>\CSC3.tmp
%TEMP%\f3akkjt5.out
%TEMP%\f3akkjt5.cmdline
%TEMP%\f3akkjt5.0.cs
%TEMP%\RES6.tmp
<Current directory>\CSC5.tmp
%TEMP%\wk3fldan.out
%TEMP%\wk3fldan.0.cs
%TEMP%\wk3fldan.cmdline
<Current directory>\x82y.exe
%TEMP%\RES8.tmp
%TEMP%\fxiw3xa0.cmdline
<Current directory>\CSCF.tmp

Substitutes the following files:

<Current directory>\x367y.exe
<Current directory>\x82y.exe
<Current directory>\x90y.exe
<Current directory>\x1491y.exe

Miscellaneous:

Executes the following:

'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\lsq5rqis.cmdline"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "<Current directory>\CSC1.tmp"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\f3akkjt5.cmdline"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "<Current directory>\CSC3.tmp"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wk3fldan.cmdline"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6.tmp" "<Current directory>\CSC5.tmp"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\fxiw3xa0.cmdline"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8.tmp" "<Current directory>\CSC7.tmp"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\p11zdf2q.cmdline"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA.tmp" "<Current directory>\CSC9.tmp"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\f544mfz3.cmdline"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC.tmp" "<Current directory>\CSCB.tmp"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\kmz3fusj.cmdline"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE.tmp" "<Current directory>\CSCD.tmp"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\wochqgld.cmdline"
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10.tmp" "<Current directory>\CSCF.tmp"