Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\OpenVPNServiceInteractive] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\OpenVPNServiceInteractive] 'ImagePath' = '"%ProgramFiles%\OpenVPN\bin\openvpnserv.exe"'
- [<HKLM>\System\CurrentControlSet\Services\OpenVPNServiceLegacy] 'ImagePath' = '"%ProgramFiles%\OpenVPN\bin\openvpnserv.exe"'
- [<HKLM>\System\CurrentControlSet\Services\OpenVPNService] 'ImagePath' = '"%ProgramFiles%\OpenVPN\bin\openvpnserv2.exe"'
Creates the following services
- 'OpenVPNServiceInteractive' "%ProgramFiles%\OpenVPN\bin\openvpnserv.exe"
- 'OpenVPNServiceInteractive' %ProgramFiles%\OpenVPN\bin\openvpnserv.exe
- 'OpenVPNServiceLegacy' "%ProgramFiles%\OpenVPN\bin\openvpnserv.exe"
- 'OpenVPNService' "%ProgramFiles%\OpenVPN\bin\openvpnserv2.exe"
- 'OpenVPNService' %ProgramFiles%\OpenVPN\bin\openvpnserv2.exe
Modifies file system
Creates the following files
- C:\temp\luisvpn\config\ca.crt
- %TEMP%\nsxb2ad.tmp\nsexec.dll
- %TEMP%\nsxc67a.tmp
- %TEMP%\nsxc67b.tmp\system.dll
- %TEMP%\nsxc67b.tmp\userinfo.dll
- %ProgramFiles%\tap-windows\bin\tapinstall.exe
- %ProgramFiles%\tap-windows\driver\oemvista.inf
- %ProgramFiles%\tap-windows\driver\tap0901.cat
- %ProgramFiles%\tap-windows\driver\tap0901.sys
- %ProgramFiles%\tap-windows\bin\addtap.bat
- %ProgramFiles%\tap-windows\bin\deltapall.bat
- %ProgramFiles%\openvpn\bin\openvpn.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tap-windows\utilities\add a new tap virtual ethernet adapter.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tap-windows\utilities\delete all tap virtual ethernet adapters.lnk
- %ProgramFiles%\tap-windows\license.txt
- %ProgramFiles%\tap-windows\icon.ico
- %TEMP%\nsxc67b.tmp\nsexec.dll
- %TEMP%\{097abd5a-79bd-1c7b-0d9f-dd11c4d5da0b}\setddb1.tmp
- %TEMP%\{097abd5a-79bd-1c7b-0d9f-dd11c4d5da0b}\setde7d.tmp
- %TEMP%\{097abd5a-79bd-1c7b-0d9f-dd11c4d5da0b}\sete013.tmp
- %HOMEPATH%\openvpn\config\ca.crt
- %HOMEPATH%\openvpn\config\luis.ovpn
- %HOMEPATH%\openvpn\config\luisuser.crt
- %ProgramFiles%\openvpn\bin\openvpnserv2.exe
- %TEMP%\tap-windows.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\openvpn\shortcuts\openvpn configuration file directory.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\openvpn\shortcuts\openvpn log file directory.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\openvpn\shortcuts\openvpn sample configuration files.lnk
- C:\temp\luisvpn\config\luisuser.key
- C:\temp\luisvpn\config\ta.key
- C:\temp\luisvpn\config\luis.ovpn
- C:\temp\luisvpn\install.bat
- C:\temp\luisvpn\luisvpn.exe
- C:\temp\luisvpn\openvpn-install-2.4.8-i602-win10.exe
- %TEMP%\nsib29d.tmp
- %TEMP%\nsxb2ad.tmp\system.dll
- %TEMP%\nsxb2ad.tmp\userinfo.dll
- %TEMP%\nsxb2ad.tmp\simplesc.dll
- %HOMEPATH%\openvpn\config\luisuser.key
- %TEMP%\nsxc67b.tmp\shelllink.dll
- %TEMP%\nsxb2ad.tmp\nsprocess.dll
- %ProgramFiles%\openvpn\doc\openvpn.8.html
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\openvpn\documentation\openvpn manual page.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\openvpn\documentation\openvpn windows notes.lnk
- %ProgramFiles%\openvpn\bin\openvpnserv.exe
- %ProgramFiles%\openvpn\config\readme.txt
- %ProgramFiles%\openvpn\sample-config\sample.ovpn
- %ProgramFiles%\openvpn\sample-config\client.ovpn
- %ProgramFiles%\openvpn\sample-config\server.ovpn
- %ProgramFiles%\openvpn\log\readme.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\openvpn\utilities\generate a static openvpn key.lnk
- C:\temp\luisvpn\config\luisuser.crt
- %ProgramFiles%\openvpn\doc\install-win32.txt
- %HOMEPATH%\openvpn\config\ta.key
Moves the following files
- from %TEMP%\{097abd5a-79bd-1c7b-0d9f-dd11c4d5da0b}\setddb1.tmp to %TEMP%\{097abd5a-79bd-1c7b-0d9f-dd11c4d5da0b}\oemvista.inf
- from %TEMP%\{097abd5a-79bd-1c7b-0d9f-dd11c4d5da0b}\setde7d.tmp to %TEMP%\{097abd5a-79bd-1c7b-0d9f-dd11c4d5da0b}\tap0901.cat
- from %TEMP%\{097abd5a-79bd-1c7b-0d9f-dd11c4d5da0b}\sete013.tmp to %TEMP%\{097abd5a-79bd-1c7b-0d9f-dd11c4d5da0b}\tap0901.sys
Miscellaneous
Searches for the following windows
- ClassName: 'OpenVPN-GUI' WindowName: ''
Creates and executes the following
- 'C:\temp\luisvpn\openvpn-install-2.4.8-i602-win10.exe' /S /D=%ProgramFiles%\OpenVPN
- '%TEMP%\tap-windows.exe' /S /SELECT_UTILITIES=1
- '%ProgramFiles%\tap-windows\bin\tapinstall.exe' hwids tap0901
- '%ProgramFiles%\tap-windows\bin\tapinstall.exe' install "%ProgramFiles%\TAP-Windows\driver\OemVista.inf" tap0901
- '%TEMP%\tap-windows.exe' /S /SELECT_UTILITIES=1' (with hidden window)
- '%ProgramFiles%\tap-windows\bin\tapinstall.exe' hwids tap0901' (with hidden window)
- '%ProgramFiles%\tap-windows\bin\tapinstall.exe' install "%ProgramFiles%\TAP-Windows\driver\OemVista.inf" tap0901' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Temp\LuisVPN\Install.bat" "
- '%WINDIR%\syswow64\timeout.exe' /T 25 /NOBREAK
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{6df47e91-b514-6301-7cb7-a61eb7fe2a34} Global\{457938cc-f5cb-0c84-c497-cb2921174c1c} <DRIVERSTORE>\Temp\{591148eb-923c-7202-e258-ba4d...
- '%WINDIR%\syswow64\timeout.exe' /T 3 /NOBREAK
