Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\online application v2g4.job
- <SYSTEM32>\tasks\online application v2g4
- %WINDIR%\tasks\online application v2g2.job
- <SYSTEM32>\tasks\online application v2g2
- %WINDIR%\tasks\online application v2g5.job
- <SYSTEM32>\tasks\online application v2g5
- %WINDIR%\tasks\online application v2g6.job
- <SYSTEM32>\tasks\online application v2g6
- %WINDIR%\tasks\online application v2g1.job
- <SYSTEM32>\tasks\online application v2g1
- %WINDIR%\tasks\updater_online_application.job
- <SYSTEM32>\tasks\updater_online_application
- %WINDIR%\tasks\online application v2g3.job
- <SYSTEM32>\tasks\online application v2g3
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im Online-Guardian* /f
Modifies file system
Creates the following files
- %TEMP%\nsm7291.tmp\inetc.dll
- %ProgramFiles(x86)%\microleaves\online application\version 2.6.0\online.io eula.url
- %ProgramFiles(x86)%\microleaves\online application\online application updater.ini
- %ProgramFiles(x86)%\microleaves\online application\version 2.6.0\uninstall online application.lnk
- %WINDIR%\installer\{5266f634-7b7d-4537-bddc-98dd6cfcbaa1}\systemfoldermsiexec.exe
- %WINDIR%\installer\{5266f634-7b7d-4537-bddc-98dd6cfcbaa1}\online.exe
- %ProgramFiles(x86)%\microleaves\online application\version 2.6.0\online-guardian.exe
- %ProgramFiles(x86)%\microleaves\online application\online application updater.exe
- %APPDATA%\microleaves\online application 2.7.0\install\cfcbaa1\version 2.6.0\online-guardian.exe
- %APPDATA%\microleaves\online application 2.7.0\install\cfcbaa1\online application updater.exe
- %TEMP%\tinf7a7.tmp.part
- %LOCALAPPDATA%\advinstanalytics\57bec79515c1ec525f8858bf\2.7.0\{7d745b2b-81dd-42f1-a025-1ac4f8844b7e}.session
- %TEMP%\tinea4e.tmp.part
- %TEMP%\msie802.tmp
- %TEMP%\msie7e2.tmp
- %TEMP%\msie5de.tmp
- %LOCALAPPDATA%\advinstanalytics\57bec79515c1ec525f8858bf\2.7.0\{c463cadd-6ff1-4480-8026-4e96c87f41c3}.session
- %LOCALAPPDATA%\advinstanalytics\57bec79515c1ec525f8858bf\2.7.0\tracking.ini
- %TEMP%\inse580.tmp
- %APPDATA%\microleaves\online application 2.7.0\install\cfcbaa1\basic installer with memory detection.msi
- %APPDATA%\microleaves\online application 2.7.0\install\decoder.dll
- %TEMP%\nsm7291.tmp\ioinst.exe
- %ProgramFiles(x86)%\microleaves\online application\version 2.6.0\online.io privacy.url
- %TEMP%\nsm7291.tmp\icall.log
Deletes the following files
- %TEMP%\msie5de.tmp
- %TEMP%\msie7e2.tmp
- %TEMP%\tinea4e.tmp
- %TEMP%\msie802.tmp
- %TEMP%\tinf7a7.tmp
- %LOCALAPPDATA%\advinstanalytics\57bec79515c1ec525f8858bf\2.7.0\{7d745b2b-81dd-42f1-a025-1ac4f8844b7e}.session
- %LOCALAPPDATA%\advinstanalytics\57bec79515c1ec525f8858bf\2.7.0\{c463cadd-6ff1-4480-8026-4e96c87f41c3}.session
- %TEMP%\inse580.tmp
- %APPDATA%\microleaves\online application 2.7.0\install\decoder.dll
- %APPDATA%\microleaves\online application 2.7.0\install\cfcbaa1\online application updater.exe
- %APPDATA%\microleaves\online application 2.7.0\install\cfcbaa1\version 2.6.0\online-guardian.exe
- %TEMP%\nsm7291.tmp\icall.log
- %TEMP%\nsm7291.tmp\inetc.dll
- %TEMP%\nsm7291.tmp\ioinst.exe
Moves the following files
- from %TEMP%\tinea4e.tmp.part to %TEMP%\tinea4e.tmp
- from %TEMP%\tinf7a7.tmp.part to %TEMP%\tinf7a7.tmp
Substitutes the following files
- %LOCALAPPDATA%\advinstanalytics\57bec79515c1ec525f8858bf\2.7.0\{c463cadd-6ff1-4480-8026-4e96c87f41c3}.session
Network activity
TCP
HTTP GET requests
- http://do######.onlineappupdater.com/us-Online.IO-installer-ic.exe
- http://d.####avirgin.io/us-Online.IO-installer-ic.exe
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://www.google.com/
- http://tr###.##eetdesign.website/track_bundle.php?a=##########
HTTP POST requests
- http://co#####.#nstalleranalytics.com/
UDP
- DNS ASK do######.onlineappupdater.com
- DNS ASK d.####avirgin.io
- DNS ASK microsoft.com
- DNS ASK google.com
- DNS ASK co#####.#nstalleranalytics.com
- DNS ASK tr###.##eetdesign.website
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\nsm7291.tmp\ioinst.exe' /qn
- '%WINDIR%\syswow64\taskkill.exe' /im Online-Guardian* /f' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%APPDATA%\Microleaves\Online Application 2.7.0\install\CFCBAA1\Basic Installer with memory detection.msi" /qn AI_SETUPEXEPATH=%TEMP%\nsm7291.tmp\ioinst.exe SETUPEXEDIR=%TEMP%\nsm7291.tmp\ E...
