Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Environment] 'UserInitMprLogonScript' = '%ALLUSERSPROFILE%\DriverStore\ntcapapi.exe'
Modifies file system
Creates the following files
- %TEMP%\7z6ec4eb24\content.bat
- %ALLUSERSPROFILE%\$dpx$.tmp\b513b9b977ac504fb1a345602a66689f.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\bee7ef27a3584e4e9daf53f23fd9c31b.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\af8321495e51b34bb2123516b1f86e54.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\f8171c74236e0d4383da16a4b32d26d9.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\8c2588387dd95c49819e0f252d7af155.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\06386f7c7d58774caeff16c3668a7e7d.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\d29633c673bd5d4eb6f925ddd7ebde45.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\dfac967eabeb7448b1fe507d621161d0.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\8133e7b614006641a1d709ade3c047d1.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\9d4670ee4126f7499f761e0759911f22.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\3bef5871d8ff234ba25edd33ec27a555.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\25b7bb93be864b44a29993172114dd10.tmp
- nul
- %TEMP%\7z6ec4eb24\verse.cab
- %ALLUSERSPROFILE%\$dpx$.tmp\e75ae7e998d95b4a8f66d1257d8d8c7d.tmp
- %ALLUSERSPROFILE%\$dpx$.tmp\1eef147bf003d54faca74ed79dcab35f.tmp
Deletes the following files
- %TEMP%\7z6ec4eb24\content.bat
- %TEMP%\7z6ec4eb24\verse.cab
Moves the following files
- from %ALLUSERSPROFILE%\$dpx$.tmp\25b7bb93be864b44a29993172114dd10.tmp to %ALLUSERSPROFILE%\driverstore\client32.ini
- from %ALLUSERSPROFILE%\$dpx$.tmp\3bef5871d8ff234ba25edd33ec27a555.tmp to %ALLUSERSPROFILE%\driverstore\client32u.ini
- from %ALLUSERSPROFILE%\$dpx$.tmp\9d4670ee4126f7499f761e0759911f22.tmp to %ALLUSERSPROFILE%\driverstore\htctl32.dll
- from %ALLUSERSPROFILE%\$dpx$.tmp\8133e7b614006641a1d709ade3c047d1.tmp to %ALLUSERSPROFILE%\driverstore\msvcr100.dll
- from %ALLUSERSPROFILE%\$dpx$.tmp\e75ae7e998d95b4a8f66d1257d8d8c7d.tmp to %ALLUSERSPROFILE%\driverstore\nskbfltr.inf
- from %ALLUSERSPROFILE%\$dpx$.tmp\dfac967eabeb7448b1fe507d621161d0.tmp to %ALLUSERSPROFILE%\driverstore\nsm.ini
- from %ALLUSERSPROFILE%\$dpx$.tmp\06386f7c7d58774caeff16c3668a7e7d.tmp to %ALLUSERSPROFILE%\driverstore\nsm.lic
- from %ALLUSERSPROFILE%\$dpx$.tmp\8c2588387dd95c49819e0f252d7af155.tmp to %ALLUSERSPROFILE%\driverstore\nsm_vpro.ini
- from %ALLUSERSPROFILE%\$dpx$.tmp\f8171c74236e0d4383da16a4b32d26d9.tmp to %ALLUSERSPROFILE%\driverstore\ntcapapi.exe
- from %ALLUSERSPROFILE%\$dpx$.tmp\af8321495e51b34bb2123516b1f86e54.tmp to %ALLUSERSPROFILE%\driverstore\pcicapi.dll
- from %ALLUSERSPROFILE%\$dpx$.tmp\bee7ef27a3584e4e9daf53f23fd9c31b.tmp to %ALLUSERSPROFILE%\driverstore\pcichek.dll
- from %ALLUSERSPROFILE%\$dpx$.tmp\b513b9b977ac504fb1a345602a66689f.tmp to %ALLUSERSPROFILE%\driverstore\pcicl32.dll
- from %ALLUSERSPROFILE%\$dpx$.tmp\d29633c673bd5d4eb6f925ddd7ebde45.tmp to %ALLUSERSPROFILE%\driverstore\remcmdstub.exe
- from %ALLUSERSPROFILE%\$dpx$.tmp\1eef147bf003d54faca74ed79dcab35f.tmp to %ALLUSERSPROFILE%\driverstore\tcctl32.dll
Network activity
Connects to
- '46.##1.40.59':3085
- 'ge#.####upportsoftware.com':80
UDP
- DNS ASK ge#.####upportsoftware.com
Miscellaneous
Searches for the following windows
- ClassName: 'NSMWClass' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\driverstore\ntcapapi.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7z6EC4EB24\content.bat" "
- '%WINDIR%\syswow64\expand.exe' verse.cab -F:* %ALLUSERSPROFILE%
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ALLUSERSPROFILE%\DriverStore\ntcapapi.exe" /f
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ALLUSERSPROFILE%\driverstore\nt...
