Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\PROTOCOLS\Handler\touchenex] 'CLSID' = '{32f68350-4cb4-11e7-a06a-005056c00008}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CrossEXService' = '%ProgramFiles(x86)%\iniLINE\CrossEX\crossex\CrossEXService.exe'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\JRSKD24] 'ImagePath' = '<SYSTEM32>\JRSKD24.SYS'
- [<HKLM>\System\CurrentControlSet\Services\CrossEX Live Checker] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\CrossEX Live Checker] 'ImagePath' = '%ProgramFiles(x86)%\iniLINE\CrossEX\crossex\ObCrossEXService.exe'
Creates the following services
- 'JRSKD24' <SYSTEM32>\JRSKD24.SYS
- 'CrossEX Live Checker' %ProgramFiles(x86)%\iniLINE\CrossEX\crossex\ObCrossEXService.exe
Modifies file system
Creates the following files
- %TEMP%\~rapack1076484\_chunk.zip
- %ProgramFiles(x86)%\iniline\crossex\crossex\uninstallcrossexlocal.exe
- %ProgramFiles(x86)%\iniline\crossex\crossex\obcrossexservice.exe
- %ProgramFiles(x86)%\iniline\crossex\crossex\crossexservice.exe
- %ProgramFiles(x86)%\iniline\crossex\crossex\crossexservice.exe.sig
- %ProgramFiles(x86)%\iniline\crossex\crossex\rootca.crt
- %TEMP%\nsg9eaf.tmp\system.dll
- %TEMP%\nsg9eaf.tmp\nsexec.dll
- %TEMP%\~rapack1076484\ffcert.exe
- %TEMP%\ffcert_raon\firefox_certutil.exe
- %TEMP%\ffcert_raon\bin\certutil.exe
- %TEMP%\ffcert_raon\bin\freebl3.dll
- %TEMP%\ffcert_raon\bin\libnspr4.dll
- %TEMP%\ffcert_raon\bin\libplc4.dll
- %TEMP%\ffcert_raon\bin\libplds4.dll
- %TEMP%\ffcert_raon\bin\msvcr100.dll
- %TEMP%\ffcert_raon\bin\nss3.dll
- %TEMP%\ffcert_raon\bin\nssckbi.dll
- %TEMP%\ffcert_raon\bin\nssdbm3.dll
- %TEMP%\ffcert_raon\bin\nssutil3.dll
- %TEMP%\ffcert_raon\bin\smime3.dll
- %TEMP%\ffcert_raon\bin\softokn3.dll
- %TEMP%\~rapack1076484\crossex_localservice_install.exe
- %TEMP%\ffcert_raon\bin\sqlite3.dll
- %TEMP%\nsw9991.tmp\system.dll
- %ProgramFiles(x86)%\raonsecure\bridge\crossex\touchenex\1.0.1.1091\kr.co.raon.touchenex.firefox.json
- %TEMP%\~rapack1076484\_install.ini
- %WINDIR%\syswow64\cksetup32.exe
- %WINDIR%\syswow64\keysharpcrypto.dll
- %WINDIR%\syswow64\cksetup64.exe
- <SYSTEM32>\ckagentnxe_t.exe
- <SYSTEM32>\ckagentnxe.dat
- <SYSTEM32>\temp_jrskd24.sys
- <SYSTEM32>\temp_jrsukd25.sys
- <SYSTEM32>\ckagent_t.exe
- <SYSTEM32>\ckagent.dat
- %WINDIR%\syswow64\ckagentnxe_t.exe
- %WINDIR%\syswow64\ckagentnxe.dat
- %WINDIR%\syswow64\ckagent_t.exe
- %WINDIR%\syswow64\ckagent.dat
- %TEMP%\~rapack1076484\raon_touchenex_install.exe
- %ProgramFiles(x86)%\raonsecure\bridge\crossex\touchenex\1.0.1.1091\crossexprotocol.dll
- %ProgramFiles(x86)%\raonsecure\bridge\crossex\touchenex\1.0.1.1091\crossexchrome.exe
- %ProgramFiles(x86)%\raonsecure\bridge\crossex\touchenex\1.0.1.1091\crossexfirefox.dll
- %ProgramFiles(x86)%\raonsecure\bridge\crossex\touchenex\1.0.1.1091\npraontouchenex.dll
- %ProgramFiles(x86)%\raonsecure\bridge\crossex\touchenex\1.0.1.1091\crossex.sig
- %ProgramFiles(x86)%\raonsecure\bridge\crossex\touchenex\1.0.1.1091\kr.co.raon.touchenex.json
- %ProgramFiles(x86)%\raonsecure\bridge\crossex\touchenex\uninstallcrossex.exe
- %TEMP%\ffcert_raon\bin\ssl3.dll
Deletes the following files
- <SYSTEM32>\jrskd24.sys
- %TEMP%\nsw9991.tmp\system.dll
- %TEMP%\nsg9eaf.tmp\nsexec.dll
- %TEMP%\nsg9eaf.tmp\system.dll
Moves the following files
- from <SYSTEM32>\ckagentnxe_t.exe to <SYSTEM32>\ckagentnxe.exe
- from <SYSTEM32>\temp_jrskd24.sys to <SYSTEM32>\jrskd24.sys
- from <SYSTEM32>\temp_jrsukd25.sys to <SYSTEM32>\jrsukd25.sys
- from <SYSTEM32>\ckagent_t.exe to <SYSTEM32>\ckagent.exe
- from %WINDIR%\syswow64\ckagentnxe_t.exe to %WINDIR%\syswow64\ckagentnxe.exe
- from %WINDIR%\syswow64\ckagent_t.exe to %WINDIR%\syswow64\ckagent.exe
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'CKAppProEx_Notify_Wnd' WindowName: 'CKAppProEx_Notify_Wnd'
- ClassName: 'CKAGENTNXE' WindowName: ''
- ClassName: 'CKAGENT' WindowName: ''
- ClassName: '' WindowName: '¼³Ä¡ - TouchEn nxKey'
- ClassName: '' WindowName: 'Install - TouchEn nxKey'
Creates and executes the following
- '%WINDIR%\syswow64\cksetup32.exe' /install appm
- '%WINDIR%\syswow64\cksetup64.exe' /update CKAgentNXE
- '%WINDIR%\syswow64\cksetup64.exe' /update CKAgent
- '%TEMP%\~rapack1076484\raon_touchenex_install.exe' /S
- '%TEMP%\~rapack1076484\crossex_localservice_install.exe' /S
- '%ProgramFiles(x86)%\iniline\crossex\crossex\crossexservice.exe'
- '%ProgramFiles(x86)%\iniline\crossex\crossex\obcrossexservice.exe'
- '%TEMP%\~rapack1076484\ffcert.exe' -noces
- '%TEMP%\ffcert_raon\firefox_certutil.exe' "%TEMP%\~RAPack1076484\FFCert.exe" -noces
- '%TEMP%\ffcert_raon\bin\certutil.exe' -L -d "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default"
- '%TEMP%\ffcert_raon\bin\certutil.exe' -A -d "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default" -i "%ProgramFiles(x86)%\iniLINE\CrossEX\crossex\rootCA.crt" -n "iniLINE CrossEx RootCA" -t "CT,C,C"
- '%WINDIR%\syswow64\sc.exe' create "CrossEX Live Checker" binpath= "%ProgramFiles(x86)%\iniLINE\CrossEX\crossex\ObCrossEXService.exe" start= auto' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description "CrossEX Live Checker" "checking live status of CrossEXService"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start "CrossEX Live Checker"' (with hidden window)
- '%TEMP%\ffcert_raon\bin\certutil.exe' -A -d "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default" -i "%ProgramFiles(x86)%\iniLINE\CrossEX\crossex\rootCA.crt" -n "iniLINE CrossEx RootCA" -t "CT,C,C"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' create "CrossEX Live Checker" binpath= "%ProgramFiles(x86)%\iniLINE\CrossEX\crossex\ObCrossEXService.exe" start= auto
- '%WINDIR%\syswow64\sc.exe' description "CrossEX Live Checker" "checking live status of CrossEXService"
- '%WINDIR%\syswow64\sc.exe' start "CrossEX Live Checker"
