Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\7856757
Modifies file system
Creates the following files
- %TEMP%\is-u5f06.tmp\<File name>.tmp
- %TEMP%\is-3afc4.tmp\_isetup\_setup64.tmp
- %ALLUSERSPROFILE%\dir\is-0m0p8.tmp
- %TEMP%\is-3afc4.tmp\is-hb3m7.tmp
- %TEMP%\is-3afc4.tmp\is-l0lfa.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\v_k-d_j\vnktoаktе_dj.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\v_k-d_j\uninstall vnktoаktе_dj.lnk
- %HOMEPATH%\desktop\vnktoаktе_dj.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\vnktoаktе_dj.lnk
- %ALLUSERSPROFILE%\dir\unins000.dat
Moves the following files
- from %ALLUSERSPROFILE%\dir\is-0m0p8.tmp to %ALLUSERSPROFILE%\dir\unins000.exe
- from %TEMP%\is-3afc4.tmp\is-hb3m7.tmp to %TEMP%\is-3afc4.tmp\7za.exe
- from %TEMP%\is-3afc4.tmp\is-l0lfa.tmp to %TEMP%\is-3afc4.tmp\logo y.bmp
Network activity
Connects to
- 'vk##.org':443
TCP
Other
- 'vk##.org':443
UDP
- DNS ASK vk##.org
Miscellaneous
Creates and executes the following
- '%TEMP%\is-u5f06.tmp\<File name>.tmp' /SL5="$14023E,1074986,831488,<Full path to file>"
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN 7856757 /SC ONLOGON /TR "%ALLUSERSPROFILE%\dir\V-K_D-J.exe /H" /F /DELAY 0001:00 /RL HIGHEST
