Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '57b6c8d9ab3bb159df550fcc8f61f6a2' = '"%TEMP%\Image.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '57b6c8d9ab3bb159df550fcc8f61f6a2' = '"%TEMP%\Image.exe" ..'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\57b6c8d9ab3bb159df550fcc8f61f6a2.exe
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\Image.exe' = '%TEMP%\Image.exe:*:Enabled:Image.exe'
Creates and executes the following:
- 'C:\Extracted\avast_premier_antivirus_setup_online.exe'
- '%TEMP%\_av_iup.tm~a02860\instup.exe' /sfx /sfx_type:lite /sfxstorage:"%TEMP%\_av_iup.tm~a02860" /edition:12 /prod:ais
- 'C:\Extracted\12244.exe'
- '%TEMP%\Image.exe'
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\Image.exe" "Image.exe" ENABLE
Modifies file system :
Creates the following files:
- %TEMP%\_av_iup.tm~a02860\part-vps_win32-14041700.vpx
- %TEMP%\_av_iup.tm~a02860\prod-ais.vpx
- %TEMP%\_av_iup.tm~a02860\part-setup_ais-7e2.vpx
- %TEMP%\_av_iup.tm~a02860\part-jrog2-a16.vpx
- %TEMP%\_av_iup.tm~a02860\part-prg_ais-7e2.vpx
- %TEMP%\_av_iup.tm~a02860\prod-vps.vpx
- %TEMP%\_av_iup.tm~a02860\instup.exe
- %TEMP%\_av_iup.tm~a02860\aswSetupOffers.def.dld
- %TEMP%\_av_iup.tm~a02860\HTMLayout.dll
- %TEMP%\_av_iup.tm~a02860\servers.def
- %TEMP%\_av_iup.tm~a02860\setgui_ais-7e2.vpx
- %TEMP%\Image.exe
- %ALLUSERSPROFILE%\Application Data\AVAST Software\Persistent Data\Avast\Logs\Setup.log
- C:\Extracted\avast_premier_antivirus_setup_online.exe
- %TEMP%\sfx.ini
- C:\Extracted\12244.exe
- %TEMP%\_av_iup.tm~a02860\avbugreport_ais-7e2.vpx
- %TEMP%\_av_iup.tm~a02860\Instup.dll
- %TEMP%\_av_iup.tm~a02860\part-iex-1.vpx
- %TEMP%\_av_iup.tm~a02860\instup_ais-7e2.vpx
- %TEMP%\_av_iup.tm~a02860\avBugReport.exe
- %TEMP%\_av_iup.tm~a02860\instcont_ais-7e2.vpx
Deletes the following files:
- %TEMP%\_av_iup.tm~a02860\servers.def.vpx
- %TEMP%\_av_iup.tm~a02860\aswSetupOffers.def
- %TEMP%\sfx.ini
Moves the following files:
- from %TEMP%\_av_iup.tm~a02860\servers.def.vpx.dld to %TEMP%\_av_iup.tm~a02860\servers.def.vpx
- from %TEMP%\_av_iup.tm~a02860\aswSetupOffers.def.dld to %TEMP%\_av_iup.tm~a02860\aswSetupOffers.def
Network activity:
Connects to:
- 'w2######.iavs9x.u.avast.com':80
- 'j2######.iavs9x.u.avast.com':80
- 'p6######.iavs9x.u.avast.com':80
- 's9######.iavs9x.u.avast.com':80
- 'pr####m.avast.com':80
- 'ya####.no-ip.org':1177
- 'n9######.iavs9x.u.avast.com':80
TCP:
HTTP GET requests:
- w2######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- j2######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- p6######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- pr####m.avast.com/setupoffers.def
- n9######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- s9######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
UDP:
- DNS ASK z8######.iavs9x.u.avast.com
- DNS ASK k6######.iavs9x.u.avast.com
- DNS ASK p6######.iavs9x.u.avast.com
- DNS ASK d9######.iavs9x.u.avast.com
- DNS ASK t6######.iavs9x.u.avast.com
- DNS ASK g2######.iavs9x.u.avast.com
- DNS ASK n9######.iavs9x.u.avast.com
- DNS ASK ya####.no-ip.org
- DNS ASK pr####m.avast.com
- DNS ASK j2######.iavs9x.u.avast.com
- DNS ASK w2######.iavs9x.u.avast.com
- DNS ASK s9######.iavs9x.u.avast.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
