Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windows defender scheduled scan 197.0.6416.64 {320.3.8498.42 s-1-5-21-1000-75fd7548}
Modifies file system
Creates the following files
- %TEMP%\is-7eyrgr3raz.tmp\<File name>.tmp
- %TEMP%\is-ovzrq40fk2.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ovzrq40fk2.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-8stapxj7xs.tmp\<File name>.tmp
- %TEMP%\is-locmb2dgll.tmp\_isetup\_setup64.tmp
- %TEMP%\is-locmb2dgll.tmp\_isetup\_isdecmp.dll
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-0il52o4fd1.tmp
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-k98px2yqig.tmp
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-bnh2yi5349.tmp
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-103xwjmh8z.tmp
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-jpuoa2hxu0.tmp
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-xdjsofc87g.tmp
- %TEMP%\support_3.6.6.5688_install.exe
- %TEMP%\is-4n8r5io0wk.tmp\support_3.6.6.5688_install.tmp
- %TEMP%\is-4gsz555jr5.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4gsz555jr5.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-xtt6cuysy6.tmp\support_3.6.6.5688_install.tmp
- %TEMP%\is-yatnbfvou0.tmp\_isetup\_setup64.tmp
- %TEMP%\is-yatnbfvou0.tmp\_isetup\_isdecmp.dll
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-ktk2q9mov8.tmp
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-tqf1tbmzeg.tmp
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-wyzlw1hk0z.tmp
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-a2olt4w29e.tmp
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-sjvnvo520w.tmp
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-0ejch75mb5.tmp
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\kis.dll
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\kxetray.exe
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\microsoft.vc80.crt.manifest
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\msvcm80.dll
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\msvcp80.dll
- %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\msvcr80.dll
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\fnhotkeyutility.exe
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\ludp.dll
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\msvcp140.dll
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\spkvol.dll
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\vcruntime140.dll
- %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\vcruntime140_1.dll
Deletes following files that it created itself
- %TEMP%\is-ovzrq40fk2.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-ovzrq40fk2.tmp\_isetup\_setup64.tmp
- %TEMP%\is-7eyrgr3raz.tmp\<File name>.tmp
- %TEMP%\is-locmb2dgll.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-locmb2dgll.tmp\_isetup\_setup64.tmp
- %TEMP%\is-8stapxj7xs.tmp\<File name>.tmp
- %TEMP%\is-4gsz555jr5.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-4gsz555jr5.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4n8r5io0wk.tmp\support_3.6.6.5688_install.tmp
- %TEMP%\is-yatnbfvou0.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-yatnbfvou0.tmp\_isetup\_setup64.tmp
- %TEMP%\is-xtt6cuysy6.tmp\support_3.6.6.5688_install.tmp
Moves the following files
- from %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-0il52o4fd1.tmp to %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\kis.dll
- from %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-k98px2yqig.tmp to %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\kxetray.exe
- from %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-bnh2yi5349.tmp to %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\microsoft.vc80.crt.manifest
- from %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-103xwjmh8z.tmp to %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\msvcm80.dll
- from %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-jpuoa2hxu0.tmp to %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\msvcp80.dll
- from %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\is-xdjsofc87g.tmp to %ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\msvcr80.dll
- from %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-ktk2q9mov8.tmp to %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\fnhotkeyutility.exe
- from %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-tqf1tbmzeg.tmp to %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\ludp.dll
- from %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-wyzlw1hk0z.tmp to %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\msvcp140.dll
- from %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-a2olt4w29e.tmp to %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\spkvol.dll
- from %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-sjvnvo520w.tmp to %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\vcruntime140.dll
- from %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\is-0ejch75mb5.tmp to %ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\vcruntime140_1.dll
Network activity
Connects to
- 'pa###bin.com':443
- '17#.#2.24.175':4782
- 'ip##o.is':443
- 'te##gram.me':443
- 'go#.##virus.kiev.ua':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?cd##############
Other
- 'pa###bin.com':443
- '17#.#2.24.175':4782
- 'ip##o.is':443
- 'te##gram.me':443
- 'go#.##virus.kiev.ua':443
UDP
- DNS ASK pa###bin.com
- DNS ASK ip##o.is
- DNS ASK te##gram.me
- DNS ASK go#.##virus.kiev.ua
Miscellaneous
Searches for the following windows
- ClassName: 'Lenovo_Utility_Window' WindowName: ''
Creates and executes the following
- '%TEMP%\is-7eyrgr3raz.tmp\<File name>.tmp' /SL5="$A01D2,3947152,828416,<Full path to file>"
- '%TEMP%\is-8stapxj7xs.tmp\<File name>.tmp' /SL5="$B01D2,3947152,828416,<Full path to file>" /VERYSILENT /PASSWORD=fec0ea7e-78d8-4937-8f46-9aacab89a3f4
- '%ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\kxetray.exe' -ScanType
- '%TEMP%\support_3.6.6.5688_install.exe'
- '%TEMP%\is-4n8r5io0wk.tmp\support_3.6.6.5688_install.tmp' /SL5="$1001F8,3758400,882176,%TEMP%\support_3.6.6.5688_INSTALL.exe"
- '%TEMP%\support_3.6.6.5688_install.exe' /VERYSILENT /PASSWORD=925722c1-cb27-42b8-b01b-714dac7f74d9
- '%TEMP%\is-xtt6cuysy6.tmp\support_3.6.6.5688_install.tmp' /SL5="$1101F8,3758400,882176,%TEMP%\support_3.6.6.5688_INSTALL.exe" /VERYSILENT /PASSWORD=925722c1-cb27-42b8-b01b-714dac7f74d9
- '%ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\fnhotkeyutility.exe' -ScanType
Restarts the analyzed sample
Executes the following
- '<Full path to file>' /VERYSILENT /PASSWORD=fec0ea7e-78d8-4937-8f46-9aacab89a3f4' (with hidden window)
- '%ALLUSERSPROFILE%\81c15a03-aa3a-461a-a7b2-f1e634691dce\kxetray.exe' -ScanType' (with hidden window)
- '%TEMP%\support_3.6.6.5688_install.exe' /VERYSILENT /PASSWORD=925722c1-cb27-42b8-b01b-714dac7f74d9' (with hidden window)
- '%ALLUSERSPROFILE%\cf5d9718-637a-4a71-a628-052e8aba54be\fnhotkeyutility.exe' -ScanType' (with hidden window)
