Technical Information
Malicious functions
Downloads
- https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/c2rreleasedata as %temp%\files\ver.txt
- http://officecdn.microsoft.com/db/5030841d-c919-4594-8d2d-84ae4f96e58e/office/data/v32.cab as %temp%\files\v32.cab
- http://officecdn.microsoft.com/db/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/office/data/v32.cab as %temp%\files\v32.cab
Modifies file system
Creates the following files
- <Current directory>\office installer.ini
- %TEMP%\files\v32.cab
- %TEMP%\files\$dpx$.tmp\e4c0db609b1eed4f9c5bc9134c12126e.tmp
- %TEMP%\files\v32.txt
- %TEMP%\files\$dpx$.tmp\97103d7ea4d76a41b6209ae7c8ea5ba9.tmp
Deletes the following files
- %TEMP%\files\v32.txt
- %TEMP%\files\v32.cab
Moves the following files
- from %TEMP%\files\$dpx$.tmp\e4c0db609b1eed4f9c5bc9134c12126e.tmp to %TEMP%\files\versiondescriptor.xml
- from %TEMP%\files\$dpx$.tmp\97103d7ea4d76a41b6209ae7c8ea5ba9.tmp to %TEMP%\files\versiondescriptor.xml
Substitutes the following files
- %TEMP%\files\v32.cab
- %TEMP%\files\v32.txt
Network activity
Connects to
- 'mr########gr.officeapps.live.com':443
- 'officecdn.microsoft.com':80
TCP
HTTP GET requests
- http://officecdn.microsoft.com/db/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab
- http://officecdn.microsoft.com/db/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
Other
- 'mr########gr.officeapps.live.com':443
UDP
- DNS ASK mr########gr.officeapps.live.com
- DNS ASK officecdn.microsoft.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\files\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
Executes the following
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\files
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -command "& { (New-Object Net.WebClient).DownloadFile('https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData', '%TEMP%\files\ver.txt') }"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -c "$Tls12 = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072); [System.Net.ServicePointManager]::SecurityProtocol = $Tls12; (New-Object Net.WebClient).DownloadFile('https://mrodev...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/db/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', '%TEMP%\files\v32.cab') }"' (with hidden window)
- '<SYSTEM32>\expand.exe' v32.cab -F:VersionDescriptor.xml %TEMP%\files' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "& { Get-Content %TEMP%\files\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/db/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab', '%TEMP%\files\v32.cab') }"' (with hidden window)
