Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM msiexec.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "SD Card Formatter 5.0.3 Setup EN.exe" /FI "PID ne 4212"
Modifies file system
Creates the following files
- nul
- %TEMP%\isd_000dd40d\sd card formatter 5.0.3 setup en.exe
- %TEMP%\isd_000dd40d\msi.dll
- %TEMP%\{fa111924-424c-4ecc-be1a-de29f7585a1e}\setup.ini
- %TEMP%\{fa111924-424c-4ecc-be1a-de29f7585a1e}\_ismsidel.ini
- %TEMP%\{fa111924-424c-4ecc-be1a-de29f7585a1e}\0x0409.ini
- %TEMP%\msi_del_903046.ps1
- %TEMP%\~c7f4.tmp
- %TEMP%\~c833.tmp
- %TEMP%\{fa111924-424c-4ecc-be1a-de29f7585a1e}\sd card formatter setup.msi
- %LOCALAPPDATA%\downloaded installations\{8cb3da01-2c4c-49d3-9ba7-ece1f7e3a390}\sd card formatter setup.msi
- %TEMP%\~cc1c.tmp
- %TEMP%\msiece1.tmp
- %TEMP%\void_923125.ps1
Deletes following files that it created itself
- %TEMP%\~c7f4.tmp
- %TEMP%\~c833.tmp
- %TEMP%\~cc1c.tmp
- %TEMP%\msiece1.tmp
- %TEMP%\void_923125.ps1
Network activity
Connects to
- 't.#e':443
UDP
- DNS ASK t.#e
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\isd_000dd40d\sd card formatter 5.0.3 setup en.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\msi_del_903046.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "%TEMP%\void_923125.ps1"
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM msiexec.exe >nul 2>&1 & taskkill /F /IM "SD Card Formatter 5.0.3 Setup EN.exe" /FI "PID ne 4212" >nul 2>&1 & rd /s /q "%LOCALAPPDATA%\Downloaded Installations\{8CB3DA01-2C4C-...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "$p='%TEMP%\ISD_000DD40D\msi.dll';for($i=0;$i -lt 4000;$i++){ if(-not (Test-Path -LiteralPath $p)){exit 0}; try{Remove-Item -LiteralPath $p -Force -Err...
- '%WINDIR%\syswow64\msiexec.exe' /i "%LOCALAPPDATA%\Downloaded Installations\{8CB3DA01-2C4C-49D3-9BA7-ECE1F7E3A390}\SD Card Formatter Setup.msi" SETUPEXEDIR="%TEMP%\ISD_000DD40D" SETUPEXENAME="SD Card Formatter 5.0.3 Setup EN...
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM msiexec.exe >nul 2>&1 & taskkill /F /IM "SD Card Formatter 5.0.3 Setup EN.exe" /FI "PID ne 4212" >nul 2>&1 & rd /s /q "%LOCALAPPDATA%\Downloaded Installations\{8CB3DA01-2C4C-...' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "$p='%TEMP%\ISD_000DD40D\msi.dll';for($i=0;$i -lt 4000;$i++){ if(-not (Test-Path -LiteralPath $p)){exit 0}; try{Remove-Item -LiteralPath $p -Force -Err...' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\msi_del_903046.ps1"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "%TEMP%\void_923125.ps1"' (with hidden window)
