Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /t /im PenTablet.exe
- '<SYSTEM32>\taskkill.exe' /f /t /im PentabletService.exe
Modifies file system
Creates the following files
- %TEMP%\is-tu2o0.tmp\<File name>.tmp
- %APPDATA%\adobe\adobe photoshop cc 2019\adobe photoshop cc 2019 settings\psuserconfig.txt
- %APPDATA%\adobe\adobe photoshop cc 2018\adobe photoshop cc 2018 settings\psuserconfig.txt
- %APPDATA%\adobe\adobe photoshop cc 2017\adobe photoshop cc 2017 settings\psuserconfig.txt
- %APPDATA%\adobe\adobe photoshop cc 2015.5\adobe photoshop cc 2015.5 settings\psuserconfig.txt
- %APPDATA%\adobe\adobe photoshop cc 2015\adobe photoshop cc 2015 settings\psuserconfig.txt
- %APPDATA%\adobe\adobe photoshop cc 2014\adobe photoshop cc 2014 settings\psuserconfig.txt
- %TEMP%\is-smg8c.tmp\listdlls.exe
- %TEMP%\is-smg8c.tmp\endwintab.bat
- %TEMP%\is-smg8c.tmp\pscc.bat
- %TEMP%\is-smg8c.tmp\license.txt
- %TEMP%\is-smg8c.tmp\checkbox2.png
- %TEMP%\is-smg8c.tmp\checkbox.png
- %TEMP%\is-smg8c.tmp\azwc.png
- %TEMP%\is-smg8c.tmp\yl.png
- %TEMP%\is-smg8c.tmp\button.png
- %TEMP%\is-smg8c.tmp\min.png
- %TEMP%\is-smg8c.tmp\close.png
- %TEMP%\is-smg8c.tmp\loading.png
- %TEMP%\is-smg8c.tmp\bg6.png
- %TEMP%\is-smg8c.tmp\bg5.png
- %TEMP%\is-smg8c.tmp\bg4.png
- %TEMP%\is-smg8c.tmp\bg3.png
- %TEMP%\is-smg8c.tmp\bg-1.png
- %TEMP%\is-smg8c.tmp\innocallback.dll
- %TEMP%\is-smg8c.tmp\botva2.dll
- %TEMP%\is-smg8c.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-smg8c.tmp\_isetup\_setup64.tmp
- nul
- %TEMP%\is-smg8c.tmp\listdlls64.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\is-smg8c.tmp\botva2.dll
- %TEMP%\is-smg8c.tmp\pscc.bat
- %TEMP%\is-smg8c.tmp\license.txt
- %TEMP%\is-smg8c.tmp\checkbox2.png
- %TEMP%\is-smg8c.tmp\checkbox.png
- %TEMP%\is-smg8c.tmp\azwc.png
- %TEMP%\is-smg8c.tmp\yl.png
- %TEMP%\is-smg8c.tmp\button.png
- %TEMP%\is-smg8c.tmp\endwintab.bat
- %TEMP%\is-smg8c.tmp\min.png
- %TEMP%\is-smg8c.tmp\loading.png
- %TEMP%\is-smg8c.tmp\bg6.png
- %TEMP%\is-smg8c.tmp\bg5.png
- %TEMP%\is-smg8c.tmp\bg4.png
- %TEMP%\is-smg8c.tmp\bg3.png
- %TEMP%\is-smg8c.tmp\bg-1.png
- %TEMP%\is-smg8c.tmp\innocallback.dll
- %TEMP%\is-smg8c.tmp\close.png
- %TEMP%\is-smg8c.tmp\listdlls.exe
Deletes the following files
- %TEMP%\is-smg8c.tmp\listdlls64.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-tu2o0.tmp\<File name>.tmp' /SL5="$100224,16363880,161280,<Full path to file>"
- '%TEMP%\is-smg8c.tmp\listdlls.exe' -d wintab32.dll /accepteula
- '%TEMP%\is-smg8c.tmp\listdlls64.exe' -d wintab32.dll /accepteula
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\is-SMG8C.tmp\EndWintab.bat""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\is-SMG8C.tmp\PSCC.bat""' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\is-SMG8C.tmp\EndWintab.bat""
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\is-SMG8C.tmp\PSCC.bat""
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\config\system"
- '<SYSTEM32>\cmd.exe' /c listdlls.exe -d wintab32.dll /accepteula
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Listdlls v3.2 - Listdlls "
- '<SYSTEM32>\find.exe' "pid:"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Copyright (C) 1997-2016 Mark Russinovich "
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Sysinternals "
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Error opening System(4): "
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Access is denied. "
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Error opening audiodg.exe(1784): "
