Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setuputility.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\ilasm.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_wp.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\edmgen.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\mscorsvw.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\addinutil.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regsql.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\regtlibv12.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regiis.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\servicemodelreg.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regbrowsers.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\smsvchost.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\addinprocess.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_state.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\microsoft.workflow.compiler.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\applaunch.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\regsvcs.exe
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setuputility.exe'
