Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\~7573434783136911323~\sg.tmp
- %TEMP%\~638593647396789520\help.chm
- %TEMP%\~638593647396789520\language\chinese_simplified.lang
- %TEMP%\~638593647396789520\language\translationhelp.rtf
- %TEMP%\~638593647396789520\1-clickcleaner.exe
- %TEMP%\~638593647396789520\checkboxcombobox.dll
- %TEMP%\~638593647396789520\cmmultiplefiles.exe
- %TEMP%\~638593647396789520\contextmenumanager.exe
- %TEMP%\~638593647396789520\devcomponents.dotnetbar2.dll
- %TEMP%\~638593647396789520\devcomponents.treegx.dll
- %TEMP%\~638593647396789520\devicemanager.exe
- %TEMP%\~638593647396789520\diskanalyzer.exe
- %TEMP%\~638593647396789520\eventviewer.exe
- %TEMP%\~638593647396789520\filesecurity.exe
- %TEMP%\~638593647396789520\hardwaremonitor.exe
- %TEMP%\~638593647396789520\ipswitcher.exe
- %TEMP%\~638593647396789520\junkfilecleaner.exe
- %TEMP%\~638593647396789520\liveupdate.exe
- %TEMP%\~638593647396789520\liveupdatecopy.exe
- %TEMP%\~638593647396789520\microsoft.win32.taskscheduler.dll
- %TEMP%\~638593647396789520\mytask.exe
- %TEMP%\~638593647396789520\networkmonitor.exe
- %TEMP%\~638593647396789520\networktools.exe
- %TEMP%\~638593647396789520\optimizationwizard.exe
- %TEMP%\~638593647396789520\processmanager.exe
- %TEMP%\~638593647396789520\registrydefrag.exe
- %TEMP%\~638593647396789520\repaircenter.exe
- %TEMP%\~638593647396789520\runshortcutcreator.exe
- %TEMP%\~638593647396789520\securitylock.exe
- %TEMP%\~638593647396789520\servicecontrollerex.dll
- %TEMP%\~638593647396789520\settingssecurity.exe
- %TEMP%\~638593647396789520\smartuninstaller.exe
- %TEMP%\~638593647396789520\startupmanager.exe
- %TEMP%\~638593647396789520\systeminfo.exe
- %TEMP%\~638593647396789520\taskdialog.dll
- %TEMP%\~638593647396789520\taskschedulermanager.exe
- %TEMP%\~638593647396789520\thispcmanager.exe
- %TEMP%\~638593647396789520\urlmanager.exe
- %TEMP%\~638593647396789520\visualcustomizer.exe
- %TEMP%\~638593647396789520\wifimanager.exe
- %TEMP%\~638593647396789520\winapp.dll
- %TEMP%\~638593647396789520\windowsappuninstaller.exe
- %TEMP%\~638593647396789520\windowsmanager.exe
- %TEMP%\~638593647396789520\winxmenueditor.exe
- %TEMP%\~638593647396789520\wmfolderres.dll
- %TEMP%\~638593647396789520\wmimageres.dll
- %TEMP%\~2052218813214660249.cmd
Sets the 'hidden' attribute to the following files
- %TEMP%\~2052218813214660249.cmd
Miscellaneous
Creates and executes the following
- '%TEMP%\~7573434783136911323~\sg.tmp' x "<Full path to file>" -y -aoa -o"%TEMP%\~638593647396789520"
- '%TEMP%\~638593647396789520\windowsmanager.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c set
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\~2052218813214660249.cmd"
- '<SYSTEM32>\cmd.exe' /c set' (with hidden window)
- '%TEMP%\~7573434783136911323~\sg.tmp' x "<Full path to file>" -y -aoa -o"%TEMP%\~638593647396789520"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\~2052218813214660249.cmd"' (with hidden window)
