Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'SocialInvoice' = '"%ProgramFiles(x86)%\Aisino\TaxCloud\MainExecuteS.exe"'
Modifies file system
Creates the following files
- <Current directory>\app\taxcloudsetup.exe
- %ProgramFiles(x86)%\aisino\taxcloud\libssl-1_1.dll
- %ProgramFiles(x86)%\aisino\taxcloud\libcurl.dll
- %ProgramFiles(x86)%\aisino\taxcloud\libcrypto-1_1.dll
- %ProgramFiles(x86)%\aisino\taxcloud\imgdecoder-png.dll
- %ProgramFiles(x86)%\aisino\taxcloud\imgdecoder-gdip.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-utility-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-time-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\log4cxx.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-string-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-runtime-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-multibyte-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-math-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-locale-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-heap-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-filesystem-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-environment-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-stdio-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\msvcm80.dll
- %ProgramFiles(x86)%\aisino\taxcloud\msvcm90.dll
- %ProgramFiles(x86)%\aisino\taxcloud\msvcp120.dll
- %ProgramFiles(x86)%\aisino\taxcloud\vccorlib120.dll
- %ProgramFiles(x86)%\aisino\taxcloud\utilities.dll
- %ProgramFiles(x86)%\aisino\taxcloud\ucrtbase.dll
- %ProgramFiles(x86)%\aisino\taxcloud\trust.txt
- %ProgramFiles(x86)%\aisino\taxcloud\soui.dll
- %ProgramFiles(x86)%\aisino\taxcloud\soui-sys-resource.dll
- %ProgramFiles(x86)%\aisino\taxcloud\shhpt.cait
- %ProgramFiles(x86)%\aisino\taxcloud\render-gdi.dll
- %ProgramFiles(x86)%\aisino\taxcloud\regasm.exe.config
- %ProgramFiles(x86)%\aisino\taxcloud\msvcrt.dll
- %ProgramFiles(x86)%\aisino\taxcloud\msvcr90.dll
- %ProgramFiles(x86)%\aisino\taxcloud\msvcr80.dll
- %ProgramFiles(x86)%\aisino\taxcloud\msvcr120.dll
- %ProgramFiles(x86)%\aisino\taxcloud\msvcr100.dll
- %ProgramFiles(x86)%\aisino\taxcloud\msvcp90.dll
- %ProgramFiles(x86)%\aisino\taxcloud\msvcp80.dll
- %ProgramFiles(x86)%\aisino\taxcloud\msvcp140.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-crt-convert-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\vcruntime140.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-util-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-sysinfo-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-console-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\sofc.dll
- %ProgramFiles(x86)%\aisino\taxcloud\regasm.exe
- %ProgramFiles(x86)%\aisino\taxcloud\microsoft.vc90.crt.manifest
- %ProgramFiles(x86)%\aisino\taxcloud\microsoft.vc80.crt.manifest
- %ProgramFiles(x86)%\aisino\taxcloud\microsoft.vc80.crt.cat
- %ProgramFiles(x86)%\aisino\taxcloud\mainexecutex.exe
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-datetime-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\mainexecutes.exe
- %ProgramFiles(x86)%\aisino\taxcloud\logctrl.cfg
- %ProgramFiles(x86)%\aisino\taxcloud\jsdevinfodll.dll
- %ProgramFiles(x86)%\aisino\taxcloud\jsdiskdll.dll
- %ProgramFiles(x86)%\aisino\taxcloud\autoupdate.exe.config
- %ProgramFiles(x86)%\aisino\taxcloud\autoupdate.exe
- %TEMP%\nsy592f.tmp\killprocdll.dll
- %TEMP%\nsy592f.tmp\system.dll
- %ProgramFiles(x86)%\aisino\taxcloud\mainexecutem.exe
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-debug-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-errorhandling-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-file-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-synch-l1-2-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-synch-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-string-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-rtlsupport-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-profile-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-processthreads-l1-1-1.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-processthreads-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-processenvironment-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-namedpipe-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-memory-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-localization-l1-2-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-libraryloader-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-interlocked-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-heap-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-handle-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-file-l2-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-file-l1-2-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\api-ms-win-core-timezone-l1-1-0.dll
- %ProgramFiles(x86)%\aisino\taxcloud\zlibwapi.dll
Deletes the following files
- %TEMP%\nsy592f.tmp\killprocdll.dll
- %TEMP%\nsy592f.tmp\system.dll
Network activity
TCP
HTTP GET requests
- http://so##########e.oss-cn-beijing.aliyuncs.com/client/setup.exe
UDP
- DNS ASK so##########e.oss-cn-beijing.aliyuncs.com
- DNS ASK ta#.#1fapiao.cn
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '<Current directory>\app\taxcloudsetup.exe'
- '%ProgramFiles(x86)%\aisino\taxcloud\mainexecutes.exe'
- '<Current directory>\app\taxcloudsetup.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles(x86)%\aisino\taxcl...
