Technical Information
Malicious functions:
Injects code into
the following user processes:
- IntelUpdate.exe
Modifies file system:
Creates the following files:
- %TEMP%\hbucxoce.0.cs
- %TEMP%\hbucxoce.cmdline
- %TEMP%\hbucxoce.out
- %TEMP%\CSC1.tmp
- %TEMP%\RES2.tmp
- %TEMP%\hbucxoce.dll
- %APPDATA%\Orcus\err_bc06dac0d2bf4a6facfa61e0af093558.dat
- %ProgramFiles%\Intel\IntelUpdate.exe
- %ProgramFiles%\Intel\IntelUpdate.exe.config
- %TEMP%\43yrgtiy.0.cs
- %TEMP%\43yrgtiy.cmdline
- %TEMP%\43yrgtiy.out
- %TEMP%\CSC3.tmp
- %TEMP%\RES4.tmp
- %TEMP%\43yrgtiy.dll
Sets the 'hidden' attribute to the following files:
- %ProgramFiles%\Intel\IntelUpdate.exe
Deletes the following files:
- %TEMP%\RES2.tmp
- %TEMP%\CSC1.tmp
- %TEMP%\hbucxoce.0.cs
- %TEMP%\hbucxoce.out
- %TEMP%\hbucxoce.dll
- %TEMP%\hbucxoce.cmdline
- %TEMP%\RES4.tmp
- %TEMP%\CSC3.tmp
Miscellaneous:
Creates and executes the following:
- '<Full path to file>'
- '%ProgramFiles%\Intel\IntelUpdate.exe'
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\hbucxoce.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\43yrgtiy.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "%TEMP%\CSC3.tmp"
