Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
- %WINDIR%\syswow64\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\aesthete_20250207143521.cleanroom.log
- %APPDATA%\dn_explore_test\restart.msg
- %APPDATA%\dn_explore_test\winx_dvd_ripper_platinum.exe
- %APPDATA%\dn_explore_test\transform.asp
- %APPDATA%\dn_explore_test\profile.dll
- %APPDATA%\dn_explore_test\libeay32.dll
- %TEMP%\aesthete_20250207143524.log
- %WINDIR%\temp\{10063c9a-c48a-4a55-bc3e-84f0f9a8feec}\.ba\bundleextensiondata.xml
- %WINDIR%\temp\{10063c9a-c48a-4a55-bc3e-84f0f9a8feec}\.ba\bootstrapperapplicationdata.xml
- %WINDIR%\temp\{10063c9a-c48a-4a55-bc3e-84f0f9a8feec}\.ba\winx_dvd_ripper_platinum.exe
- %WINDIR%\temp\{10063c9a-c48a-4a55-bc3e-84f0f9a8feec}\.ba\transform.asp
- %WINDIR%\temp\{10063c9a-c48a-4a55-bc3e-84f0f9a8feec}\.ba\restart.msg
- %WINDIR%\temp\{10063c9a-c48a-4a55-bc3e-84f0f9a8feec}\.ba\profile.dll
- %WINDIR%\temp\{10063c9a-c48a-4a55-bc3e-84f0f9a8feec}\.ba\libeay32.dll
- %WINDIR%\temp\{10063c9a-c48a-4a55-bc3e-84f0f9a8feec}\.ba\serum.dll
- %WINDIR%\temp\{af180d73-045f-49fd-a269-87056fc8dc25}\.cr\<File name>.exe
- %TEMP%\cbc54b01
- %TEMP%\fnukp
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\{af180d73-045f-49fd-a269-87056fc8dc25}\.cr\<File name>.exe' -burn.clean.room="<Full path to file>" -burn.filehandle.attached=188 -burn.filehandle.self=184
- '%WINDIR%\temp\{10063c9a-c48a-4a55-bc3e-84f0f9a8feec}\.ba\winx_dvd_ripper_platinum.exe'
- '%APPDATA%\dn_explore_test\winx_dvd_ripper_platinum.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\explorer.exe'
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
- '%ProgramFiles%\mozilla firefox\firefox.exe'
- '%ProgramFiles%\windows media player\wmpdmc.exe'
- '<SYSTEM32>\dllhost.exe'
