Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\12773ae1b4dfec7e4cad6e559efa36c4
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\--] 'ImagePath' = '<Full path to file> /wl 1'
- [HKLM\SYSTEM\CurrentControlSet\Services\7b8eedb023edee81a6f311dabddebf54] 'Start' = '00000001'
- [HKLM\SYSTEM\CurrentControlSet\Services\7b8eedb023edee81a6f311dabddebf54] 'ImagePath' = '<DRIVERS>\7b8eedb023edee81a6f311dabddebf54.sys'
- [HKLM\SYSTEM\CurrentControlSet\Services\12773ae1b4dfec7e4cad6e559efa36c4] 'ImagePath' = '"%ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\596522b7ddf7b5c4958d8b1398b186ae.exe"'
- [HKLM\SYSTEM\CurrentControlSet\Services\12773ae1b4dfec7e4cad6e559efa36c4] 'Start' = '00000002'
Creates the following services
- '--' <Full path to file> /wl 1
- '7b8eedb023edee81a6f311dabddebf54' <DRIVERS>\7b8eedb023edee81a6f311dabddebf54.sys
- '12773ae1b4dfec7e4cad6e559efa36c4' C:\Program FilesW73ae1b4dfec7e4cad6e559efa36c496522b7ddf7b5c4958d8b1398b186ae.exe
- '12773ae1b4dfec7e4cad6e559efa36c4' %ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\596522b7ddf7b5c4958d8b1398b186ae.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "& {Add-MpPreference -ExclusionPath @('%WINDIR%\uninstaller.dat', '%WINDIR%\d04fb0e03134ae92bb98ed5a402c15fb.exe', '<DRIVERS>\7b8eedb023edee81a6f311dabddebf54.sys', '%ProgramFiles%\127...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "& {Add-MpPreference -ExclusionPath @('%ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\', '<DRIVERS>\7b8eedb023edee81a6f311dabddebf54.sys', '%WINDIR%\d04fb0e03134ae92bb98ed5a402c15fb.e...
Modifies file system
Creates the following files
- %TEMP%\nsi8317.tmp
- %TEMP%\nsi8328.tmp\system.dll
- %TEMP%\nsi8328.tmp\md5dll.dll
- %TEMP%\nsi8328.tmp\brh.dat
- %TEMP%\nsi8328.tmp\nsexec.dll
- %WINDIR%\temp\nsma555.tmp
- %WINDIR%\temp\nsma556.tmp\system.dll
- %WINDIR%\temp\nsma556.tmp\md5dll.dll
- %WINDIR%\temp\nsma556.tmp\brh.dat
- %WINDIR%\temp\nsma556.tmp\brh.dll
- %WINDIR%\temp\__psscriptpolicytest_kg3ly3sr.ypr.ps1
- %WINDIR%\temp\__psscriptpolicytest_imtjackr.sqz.psm1
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-34-226.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-34-350.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-34-739.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-35-087.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-35-487.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-35-603.dump
- %WINDIR%\temp\__psscriptpolicytest_1bffdkqc.uf2.ps1
- %WINDIR%\temp\__psscriptpolicytest_t4hmzyb2.o34.psm1
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-36-074.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-36-121.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-36-209.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-36-452.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-36-917.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-37-350.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-37-714.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-37-785.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-37-986.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-38-070.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-38-156.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-38-272.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-38-341.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-40-172.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-40-304.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-40-397.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-40-413.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-40-500.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-40-530.dump
- %WINDIR%\temp\content\5112-3336-powershell.exe-15-15-40-669.dump
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %TEMP%\nsi8328.tmp\brh.dll
- %TEMP%\nsi8328.tmp\ipconfig.dll
- %TEMP%\nsi8328.tmp\inetc.dll
- %TEMP%\nsi8328.tmp\moreinfo.dll
- %TEMP%\nsi8328.tmp\nsislist.dll
- %ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\6a276d02f055ce9afc00489b8f080ad9.ico
- %TEMP%\nsi8328.tmp\simplesc.dll
- %ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\f0920bf514f89cd8f89b1e6b2ddebe10
- <DRIVERS>\7b8eedb023edee81a6f311dabddebf54.sys
- %ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\596522b7ddf7b5c4958d8b1398b186ae.exe
- %ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\service_64.dat
- %ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\f12ed3f947356d922957cd7fb0bf96d2.exe
- %ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\service.dat
- %WINDIR%\temp\__psscriptpolicytest_1ssdsmr2.kai.ps1
- %WINDIR%\temp\__psscriptpolicytest_xwxxw4yt.kii.psm1
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-16-650.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-16-712.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-16-985.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-17-154.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-17-418.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-17-471.dump
- %WINDIR%\temp\__psscriptpolicytest_k2c2fl34.dxw.ps1
- %WINDIR%\temp\__psscriptpolicytest_stmmhib1.bqd.psm1
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-17-742.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-17-805.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-17-874.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-18-045.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-18-246.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-18-362.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-18-513.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-18-582.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-18-613.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-18-651.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-18-698.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-18-745.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-18-796.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-19-366.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-19-436.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-19-467.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-19-482.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-19-536.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-19-567.dump
- %WINDIR%\temp\content\3012-1132-powershell.exe-15-16-19-636.dump
- %WINDIR%\temp\__psscriptpolicytest_ytmhga2k.hid.ps1
- %WINDIR%\temp\__psscriptpolicytest_o1ignrq3.4x1.psm1
- %WINDIR%\syswow64\ssl\cert.db
- %WINDIR%\syswow64\ssl\fffef1770d86bbe5 2.cer
- ctrlsm7b8eedb023edee81a6f311dabddebf54
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-24-785.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-24-939.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-25-240.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-25-411.dump
- %WINDIR%\temp\__psscriptpolicytest_gjiyzyo2.isz.ps1
- %WINDIR%\temp\__psscriptpolicytest_l5rru0u0.a5m.psm1
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-25-819.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-25-923.dump
- %WINDIR%\temp\__psscriptpolicytest_bfvsdicq.r0b.ps1
- %WINDIR%\temp\__psscriptpolicytest_4e1lc1gt.oih.psm1
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-26-304.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-26-369.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-26-402.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-26-526.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-26-551.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-26-781.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-26-813.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-26-970.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-27-094.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-28-061.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-28-073.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-28-167.dump
- %WINDIR%\temp\__psscriptpolicytest_mez4alpe.vtv.ps1
- %WINDIR%\temp\__psscriptpolicytest_05p0egi2.dox.psm1
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-28-263.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-28-318.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-28-361.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-28-382.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-28-403.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-28-422.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-28-454.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-28-488.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-28-488.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-28-530.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-28-629.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-28-881.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-29-012.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-29-151.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-29-213.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-29-236.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-29-267.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-29-283.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-29-314.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-29-336.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-29-352.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-29-383.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-29-437.dump
- %WINDIR%\temp\content\3112-788-powershell.exe-15-16-29-437.dump
- C:\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-29-484.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-29-584.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-30-519.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-30-662.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-30-741.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-30-750.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-30-760.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-30-852.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-30-905.dump
- %WINDIR%\temp\content\5004-4868-powershell.exe-15-16-31-139.dump
- %WINDIR%\temp\__psscriptpolicytest_hx0gpdu2.o1e.ps1
- %WINDIR%\temp\__psscriptpolicytest_pi32s0hb.svn.psm1
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-35-108.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-35-219.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-35-417.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-35-537.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-35-759.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-35-809.dump
- %WINDIR%\temp\__psscriptpolicytest_joe0land.eea.ps1
- %WINDIR%\temp\__psscriptpolicytest_nxyjh450.cyu.psm1
- %ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\d04fb0e03134ae92bb98ed5a402c15fb.exe
- %WINDIR%\d04fb0e03134ae92bb98ed5a402c15fb.exe
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-36-601.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-36-648.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-36-717.dump
- %ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\wbe_uninstall.dat
- %WINDIR%\uninstaller.dat
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-36-865.dump
- %TEMP%\ac87.tmp
- %TEMP%\aca8.tmp
- %TEMP%\aca8.tmp-shm
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-37-120.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-37-236.dump
- %TEMP%\ae01.tmp
- %TEMP%\ae22.tmp
- %TEMP%\ae22.tmp-shm
- %TEMP%\nslae71.tmp
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-37-554.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-37-608.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-37-655.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-37-724.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-37-771.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-37-809.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-37-840.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-38-343.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-38-443.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-38-474.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-38-528.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-38-560.dump
- %WINDIR%\temp\content\3756-3636-powershell.exe-15-16-38-628.dump
- %WINDIR%\temp\__psscriptpolicytest_02ljviqj.50c.ps1
- %WINDIR%\temp\__psscriptpolicytest_id25qmgk.5lt.psm1
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-41-891.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-41-969.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-42-154.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-42-292.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-42-471.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-42-555.dump
- %WINDIR%\temp\__psscriptpolicytest_s1u2g3jr.qxe.ps1
- %WINDIR%\temp\__psscriptpolicytest_xxdoqeog.igu.psm1
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-42-740.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-42-772.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-42-825.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-42-941.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-43-095.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-43-196.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-43-339.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-43-393.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-43-446.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-43-498.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-43-543.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-43-574.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-43-616.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-44-154.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-44-222.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-44-254.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-44-315.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-44-336.dump
- %WINDIR%\temp\content\4056-1768-powershell.exe-15-16-44-407.dump
- %WINDIR%\temp\__psscriptpolicytest_pguk0zml.40q.ps1
- %WINDIR%\temp\__psscriptpolicytest_f0uww0zr.bwn.psm1
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-50-108.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-50-192.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-50-409.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-51-325.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-51-536.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-51-589.dump
- %WINDIR%\temp\__psscriptpolicytest_aoupsibb.sbv.ps1
- %WINDIR%\temp\__psscriptpolicytest_cf0rfidb.bew.psm1
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-52-062.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-52-113.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-52-201.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-52-600.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-52-791.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-55-657.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-58-377.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-58-717.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-58-798.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-58-862.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-58-915.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-58-967.dump
- %WINDIR%\temp\content\4532-3000-powershell.exe-15-16-59-009.dump
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_kg3ly3sr.ypr.ps1
- %WINDIR%\temp\__psscriptpolicytest_imtjackr.sqz.psm1
- %WINDIR%\temp\__psscriptpolicytest_1bffdkqc.uf2.ps1
- %WINDIR%\temp\__psscriptpolicytest_t4hmzyb2.o34.psm1
- %WINDIR%\temp\nsma556.tmp\brh.dat
- %WINDIR%\temp\nsma556.tmp\brh.dll
- %WINDIR%\temp\nsma556.tmp\md5dll.dll
- %WINDIR%\temp\nsma556.tmp\system.dll
- %WINDIR%\temp\__psscriptpolicytest_1ssdsmr2.kai.ps1
- %WINDIR%\temp\__psscriptpolicytest_xwxxw4yt.kii.psm1
- %WINDIR%\temp\__psscriptpolicytest_k2c2fl34.dxw.ps1
- %WINDIR%\temp\__psscriptpolicytest_stmmhib1.bqd.psm1
- %WINDIR%\temp\__psscriptpolicytest_ytmhga2k.hid.ps1
- %WINDIR%\temp\__psscriptpolicytest_o1ignrq3.4x1.psm1
- %WINDIR%\temp\__psscriptpolicytest_gjiyzyo2.isz.ps1
- %WINDIR%\temp\__psscriptpolicytest_l5rru0u0.a5m.psm1
- %WINDIR%\temp\__psscriptpolicytest_bfvsdicq.r0b.ps1
- %WINDIR%\temp\__psscriptpolicytest_4e1lc1gt.oih.psm1
- %WINDIR%\temp\__psscriptpolicytest_mez4alpe.vtv.ps1
- %WINDIR%\temp\__psscriptpolicytest_05p0egi2.dox.psm1
- %WINDIR%\temp\__psscriptpolicytest_hx0gpdu2.o1e.ps1
- %WINDIR%\temp\__psscriptpolicytest_pi32s0hb.svn.psm1
- %WINDIR%\temp\__psscriptpolicytest_joe0land.eea.ps1
- %WINDIR%\temp\__psscriptpolicytest_nxyjh450.cyu.psm1
- %TEMP%\ac87.tmp
- %TEMP%\aca8.tmp-shm
- %TEMP%\aca8.tmp
- %TEMP%\ae01.tmp
- %TEMP%\ae22.tmp-shm
- %TEMP%\ae22.tmp
- %TEMP%\nslae71.tmp
- %WINDIR%\temp\__psscriptpolicytest_02ljviqj.50c.ps1
- %WINDIR%\temp\__psscriptpolicytest_id25qmgk.5lt.psm1
- %WINDIR%\temp\__psscriptpolicytest_s1u2g3jr.qxe.ps1
- %WINDIR%\temp\__psscriptpolicytest_xxdoqeog.igu.psm1
- %WINDIR%\temp\__psscriptpolicytest_pguk0zml.40q.ps1
- %WINDIR%\temp\__psscriptpolicytest_f0uww0zr.bwn.psm1
- %WINDIR%\temp\__psscriptpolicytest_aoupsibb.sbv.ps1
- %WINDIR%\temp\__psscriptpolicytest_cf0rfidb.bew.psm1
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\local state
- %APPDATA%\opera software\opera stable\local state
Network activity
UDP
- DNS ASK te######gietravassac.com
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\596522b7ddf7b5c4958d8b1398b186ae.exe' --install
- '%ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\596522b7ddf7b5c4958d8b1398b186ae.exe'
- '%ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\596522b7ddf7b5c4958d8b1398b186ae.exe' --install_ff_cert
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\sc.exe' create -- binPath= ""<Full path to file>" /wl 1"
- '%WINDIR%\syswow64\net.exe' start --
- '%WINDIR%\syswow64\net1.exe' start --
- '%WINDIR%\syswow64\sc.exe' delete --
- '%WINDIR%\syswow64\sc.exe' create 7b8eedb023edee81a6f311dabddebf54 binpath= <DRIVERS>\7b8eedb023edee81a6f311dabddebf54.sys DisplayName= 7b8eedb023edee81a6f311dabddebf54 type= kernel start= system group= PNP_TDI
- '%WINDIR%\syswow64\sc.exe' start 7b8eedb023edee81a6f311dabddebf54
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC ONSTART /TN 12773ae1b4dfec7e4cad6e559efa36c4 /TR "sc start 12773ae1b4dfec7e4cad6e559efa36c4" /RU SYSTEM /F
- '%WINDIR%\syswow64\sc.exe' failure 12773ae1b4dfec7e4cad6e559efa36c4 reset= 60 actions= restart/5000/restart/5000/restart/5000
- '%WINDIR%\syswow64\sc.exe' create -- binPath= ""<Full path to file>" /wl 1"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start --' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete --' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create 7b8eedb023edee81a6f311dabddebf54 binpath= <DRIVERS>\7b8eedb023edee81a6f311dabddebf54.sys DisplayName= 7b8eedb023edee81a6f311dabddebf54 type= kernel start= system group= PNP_TDI' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start 7b8eedb023edee81a6f311dabddebf54' (with hidden window)
- '%ProgramFiles%\12773ae1b4dfec7e4cad6e559efa36c4\596522b7ddf7b5c4958d8b1398b186ae.exe' --install' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' failure 12773ae1b4dfec7e4cad6e559efa36c4 reset= 60 actions= restart/5000/restart/5000/restart/5000' (with hidden window)
