Technical Information
Modifies file system
Creates the following files
- %TEMP%\tsu-0728.dll
- %TEMP%\_tin79a0.bat
- %TEMP%\_tinacb9.bat
- %TEMP%\_tin6ade.vbs
- %TEMP%\_tinb432.vbs
- %TEMP%\_tin96a8.vbs
- %TEMP%\_tin6fb9.vbs
- %TEMP%\_tinbc06.vbs
- %TEMP%\1df8040f\x64\regsvr32.exe
- %TEMP%\1df8040f\x86\regsvr32.exe
- %PROGRAMDATA%\installmate\{dbb02f63-2284-42aa-b1bc-f2912bc5b32b}\tsudll.dll
- %PROGRAMDATA%\installmate\{dbb02f63-2284-42aa-b1bc-f2912bc5b32b}\0.ini.tmp
- %PROGRAMDATA%\installmate\{dbb02f63-2284-42aa-b1bc-f2912bc5b32b}\setup.exe
- %PROGRAMDATA%\installmate\{dbb02f63-2284-42aa-b1bc-f2912bc5b32b}\setup.ico
- %PROGRAMDATA%\installmate\{dbb02f63-2284-42aa-b1bc-f2912bc5b32b}\_setup.dll
- %PROGRAMDATA%\installmate\1df8040f\cfg\1.ini.tmp
- %TEMP%\_tin31bb.bat
- %TEMP%\1df8040f\setup.exe
- %TEMP%\1df8040f\_setupx.dll
- %TEMP%\1df8040f\setup.ico
- %TEMP%\1df8040f\_setup.dll
- %TEMP%\1df8040f.dat
- %TEMP%\<File name>.log
- %PROGRAMDATA%\installmate\{dbb02f63-2284-42aa-b1bc-f2912bc5b32b}\_setupx.dll
- %PROGRAMDATA%\installmate\{dbb02f63-2284-42aa-b1bc-f2912bc5b32b}\setup.dat
Sets the 'hidden' attribute to the following files
- %TEMP%\tsu-0728.dll
- %TEMP%\1df8040f.dat
- %TEMP%\1df8040f\_setup.dll
- %TEMP%\1df8040f\setup.ico
- %TEMP%\1df8040f\_setupx.dll
- %TEMP%\1df8040f\setup.exe
- %PROGRAMDATA%\installmate\{dbb02f63-2284-42aa-b1bc-f2912bc5b32b}\setup.dat
Deletes the following files
- %TEMP%\1df8040f.dat
- %TEMP%\1df8040f\_setup.dll
- %TEMP%\1df8040f\_setupx.dll
- %TEMP%\1df8040f\setup.exe
- %TEMP%\1df8040f\setup.ico
- %TEMP%\tsu-0728.dll
- %TEMP%\_tin79a0.bat
- %TEMP%\1df8040f\x64\regsvr32.exe
- %TEMP%\_tinacb9.bat
- %TEMP%\_tin6ade.vbs
- %TEMP%\_tinb432.vbs
- %TEMP%\_tin96a8.vbs
- %TEMP%\_tin6fb9.vbs
- %TEMP%\_tinbc06.vbs
- %TEMP%\_tin31bb.bat
- %PROGRAMDATA%\installmate\1df8040f\cfg\1.ini
- %TEMP%\1df8040f\x86\regsvr32.exe
Moves the following files
- from %PROGRAMDATA%\installmate\1df8040f\cfg\1.ini.tmp to %PROGRAMDATA%\installmate\1df8040f\cfg\1.ini
- from %PROGRAMDATA%\installmate\{dbb02f63-2284-42aa-b1bc-f2912bc5b32b}\0.ini.tmp to %PROGRAMDATA%\installmate\{dbb02f63-2284-42aa-b1bc-f2912bc5b32b}\0.ini
- from %TEMP%\<File name>.log to %PROGRAMDATA%\installmate\{dbb02f63-2284-42aa-b1bc-f2912bc5b32b}\20200220165553.log
Substitutes the following files
- %TEMP%\_tinbc06.vbs
- %TEMP%\_tin96a8.vbs
Network activity
TCP
HTTP GET requests
- http://www.pr####msoft.info/dynamic/get_configuration.php?in############################################
UDP
- DNS ASK pr####msoft.info
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tinBC06.vbs"
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tin6FB9.vbs"
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tin96A8.vbs"
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tinB432.vbs"
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tin6ADE.vbs"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\_tin31BB.bat"' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tinBC06.vbs"' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tin6FB9.vbs"' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tin96A8.vbs"' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tinB432.vbs"' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tin6ADE.vbs"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\_tinACB9.bat"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\_tin79A0.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\_tin31BB.bat"
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tinBC06.vbs"
- '%WINDIR%\syswow64\wscript.exe' /nologo "%TEMP%\_tin96A8.vbs"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\_tinACB9.bat"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\_tin79A0.bat"
