Technical Information
Modifies file system
Creates the following files
- %WINDIR%\server.crt
- %TEMP%\aut7d2a.tmp
- %WINDIR%\02586b0c.exe
- conout$
Deletes the following system files
- <DRIVERS>\etc\hosts
Deletes following files that it created itself
- %WINDIR%\server.crt
- %TEMP%\aut7d2a.tmp
Substitutes the HOSTS file.
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
- 'x1.#.lencr.org':80
- '3.###.49.130':80
- '3.###.49.130':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://3.###.49.130/server.crt
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6c##############
Other
- 'ra#.####ubusercontent.com':443
- '3.###.49.130':443
UDP
- DNS ASK ra#.####ubusercontent.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath '%WINDIR%\server.crt' -CertStoreLocation 'Cert:\LocalMachine\Root' -ErrorAction SilentlyContinue"
- '%WINDIR%\02586b0c.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath '%WINDIR%\server.crt' -CertStoreLocation 'Cert:\LocalMachine\Root' -ErrorAction SilentlyContinue"' (with hidden window)
