Technical Information
Triggers a user-defined sigma rule:
- f4bbd493-b796-416e-bbf2-121235348529
- e4a74e34-ecde-4aab-b2fb-9112dd01aed0
- dcaa3f04-70c3-427a-80b4-b870d73c94c4
- ec82e2a5-81ea-4211-a1f8-37a0286df2c2
- edf3485d-dac4-4d50-90e4-b0e5813f7e60
- 9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f
- 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
- 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8
- 48bfd177-7cf2-412b-ad77-baf923489e82
- c79da740-5030-45ec-a2e0-479e824a562c
- d7bcd677-645d-4691-a8d4-7a5602b780d1
- 3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d
- 15434e33-5027-4914-88d5-3d4145ec25a9
- 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32
- ac175779-025a-4f12-98b0-acdaeb77ea85
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\7bd05e86-856a-41e9-9575-958bcf9248b8.tmp
- <Current directory>\proxy.ps1
- %TEMP%\pefj3cop\pefj3cop.0.cs
- %TEMP%\pefj3cop\pefj3cop.cmdline
- %TEMP%\pefj3cop\pefj3cop.out
- %TEMP%\pefj3cop\csc365244dff7b41ceaddb2c35ed2a20a6.tmp
- %TEMP%\resb6dd.tmp
- %TEMP%\pefj3cop\pefj3cop.dll
- nul
- %WINDIR%\temp\addon-cne.edon.0noddapmtrgagpmt.node
- %WINDIR%\temp\addon-cne.edon.1noddapmtrgagpmt.node
- %WINDIR%\temp\addon-cne.edon.2noddapmtrgagpmt.node
- %WINDIR%\temp\addon-cne.edon.ipapdpmtrgagpmt.node
Deletes following files that it created itself
- %TEMP%\resb6dd.tmp
- %TEMP%\pefj3cop\csc365244dff7b41ceaddb2c35ed2a20a6.tmp
- %TEMP%\pefj3cop\pefj3cop.dll
- %TEMP%\pefj3cop\pefj3cop.0.cs
- %TEMP%\pefj3cop\pefj3cop.out
- %TEMP%\pefj3cop\pefj3cop.cmdline
- <Current directory>\proxy.ps1
Network activity
Connects to
- 'ch#####.amazonaws.com':443
- 'ip##i.co':443
- 'ip##pi.com':80
- 'ap#.#erion.cc':80
TCP
HTTP GET requests
- http://ip##pi.com/json
Other
- 'ch#####.amazonaws.com':443
- 'ip##i.co':443
UDP
- DNS ASK ch#####.amazonaws.com
- DNS ASK ip##i.co
- DNS ASK ip##pi.com
- DNS ASK my##.#pendns.com
- DNS ASK ap#.#erion.cc
- DNS ASK po##.ntp.org
- 'po##.ntp.org':123
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"
- '<SYSTEM32>\cmd.exe' /d /s /c "type "<Current directory>\proxy.ps1" | powershell.exe -noprofile -"
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\cmd.exe' /S /D /c" type "<Current directory>\proxy.ps1" "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noprofile -
- '<SYSTEM32>\net1.exe' session
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\pefj3cop\pefj3cop.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB6DD.tmp" "%TEMP%\pefj3cop\CSC365244DFF7B41CEADDB2C35ED2A20A6.TMP"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get totalphysicalmemory /format:value"
- '<SYSTEM32>\wbem\wmic.exe' computersystem get totalphysicalmemory /format:value
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001' -Name HwProf...
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name B...
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SYSTEM\CurrentControlSet\Services\Disk\Enum' -Name 0"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDef...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001' -Name HwProfileGuid"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SYSTEM\CurrentControlSet\Services\Disk\Enum' -Name 0"
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name CurrentBuildNumber"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name CurrentBuildNumber"
- '<SYSTEM32>\cmd.exe' /d /s /c "cmd /c powershell -Command "Get-WinSystemLocale | Select-Object -ExpandProperty Name""
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Get-WinSystemLocale | Select-Object -ExpandProperty Name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-WinSystemLocale | Select-Object -ExpandProperty Name"
- '<SYSTEM32>\cmd.exe' /d /s /c "cmd /c powershell -Command "[System.Globalization.CultureInfo]::CurrentCulture.Name""
- '<SYSTEM32>\cmd.exe' /c powershell -Command "[System.Globalization.CultureInfo]::CurrentCulture.Name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "[System.Globalization.CultureInfo]::CurrentCulture.Name"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKEY_CURRENT_USER\Control Panel\International" /v LocaleName"
- '<SYSTEM32>\reg.exe' query "HKEY_CURRENT_USER\Control Panel\International" /v LocaleName
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk get Caption,FreeSpace,Size,VolumeSerialNumber,Description /format:list"
- '<SYSTEM32>\wbem\wmic.exe' logicaldisk get Caption,FreeSpace,Size,VolumeSerialNumber,Description /format:list
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$avs = Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct; foreach ($item in $avs) { $state = $...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$avs = Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct; foreach ($item in $avs) { $state = $item.productState;...
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk where "DeviceID='C:'" get FreeSpace,Size /format:value"
- '<SYSTEM32>\wbem\wmic.exe' logicaldisk where "DeviceID='C:'" get FreeSpace,Size /format:value
- '<SYSTEM32>\cmd.exe' /d /s /c "echo %NUMBER_OF_PROCESSORS%"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk get size"
- '<SYSTEM32>\wbem\wmic.exe' logicaldisk get size
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic CPU get Name /format:value"
- '<SYSTEM32>\wbem\wmic.exe' CPU get Name /format:value
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic PATH Win32_VideoController get Name /format:value"
- '<SYSTEM32>\wbem\wmic.exe' PATH Win32_VideoController get Name /format:value
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Resolve-DnsName -Name myip.opendns.com -Server 20#.#7.222.220).IPAddress"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Resolve-DnsName -Name myip.opendns.com -Server 20#.#7.222.220).IPAddress"
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $env:PROCESSOR_ARCHITECTURE
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $env:PROCESSOR_ARCHITECTURE
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-Item '%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe').VersionInfo.FileVersion"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-Item '%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe').VersionInfo.FileVersion"
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "type "<Current directory>\proxy.ps1" | powershell.exe -noprofile -"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\pefj3cop\pefj3cop.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB6DD.tmp" "%TEMP%\pefj3cop\CSC365244DFF7B41CEADDB2C35ED2A20A6.TMP"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get totalphysicalmemory /format:value"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001' -Name HwProf...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name B...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SYSTEM\CurrentControlSet\Services\Disk\Enum' -Name 0"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name CurrentBuildNumber"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "cmd /c powershell -Command "Get-WinSystemLocale | Select-Object -ExpandProperty Name""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "cmd /c powershell -Command "[System.Globalization.CultureInfo]::CurrentCulture.Name""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKEY_CURRENT_USER\Control Panel\International" /v LocaleName"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk get Caption,FreeSpace,Size,VolumeSerialNumber,Description /format:list"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$avs = Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct; foreach ($item in $avs) { $state = $...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk where "DeviceID='C:'" get FreeSpace,Size /format:value"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "echo %NUMBER_OF_PROCESSORS%"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk get size"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic CPU get Name /format:value"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic PATH Win32_VideoController get Name /format:value"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Resolve-DnsName -Name myip.opendns.com -Server 20#.#7.222.220).IPAddress"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command $env:PROCESSOR_ARCHITECTURE' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-Item '%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe').VersionInfo.FileVersion"' (with hidden window)
