Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{95716cce-fc71-413f-8ad5-56c2892d4b3a}' = '"%ALLUSERSPROFILE%\Package Cache\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\vcredi...
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{615bc16d-60f5-482e-91b3-b51d8130963b}' = '"%ALLUSERSPROFILE%\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredi...
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}' = '"%ALLUSERSPROFILE%\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredi...
Modifies file system
Creates the following files
- %TEMP%\tmp4e8c.tmp
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\thm.xml
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\thm.wxl
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\logo.png
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\license.rtf
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_x86_20210720061219.log
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.be\vcredist_x86.exe
- %ALLUSERSPROFILE%\package cache\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\vcredist_x86.exe
- %ALLUSERSPROFILE%\package cache\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\state.rsm
- %TEMP%\tmp4e8c\0x0411.ini
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\wixstdba.dll
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\wixstdba.dll
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\logo.png
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\license.rtf
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_x86_20210720061227.log
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\wixstdba.dll
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\thm.xml
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\thm.wxl
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\logo.png
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\license.rtf
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\thm.xml
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\thm.wxl
- %TEMP%\tmp4e8c\0x0409.ini
- %TEMP%\tmp4e8c\0x0407.ini
- %TEMP%\tmp4e8c\0x0404.ini
- %TEMP%\tmp4e8c\0x0804.ini
- %TEMP%\tmp4e8c\2052.mst
- %TEMP%\tmp4e8c\isbew64.exe
- %TEMP%\tmp4e8c\isrt.dll
- %TEMP%\tmp4e8c\issetup.dll
- %TEMP%\tmp4e8c\license.rtf
- %TEMP%\tmp4e8c\microsoft visual c++ 2012 update 3 redistributable package (x86).prq
- %TEMP%\tmp4e8c\nsfw.dll
- %TEMP%\tmp4e8c\nslicense.dll
- %TEMP%\tmp4e8c\setup.exe
- %TEMP%\tmp4e8c\0x0412.ini
- %TEMP%\tmp4e8c\setup.ini
- %TEMP%\tmp4e8c\splash.bmp
- %TEMP%\tmp4e8c\splugin.dll
- %TEMP%\tmp4e8c\string2052.txt
- %TEMP%\tmp4e8c\vcredist_x86.exe
- %TEMP%\tmp4e8c\xmanager 5.msi
- %TEMP%\tmp4e8c\xmanager top.bmp
- %TEMP%\tmp4e8c\_isres_0x0804.dll
- %TEMP%\tmp4e8c\_isuser_0x0804.dll
- %TEMP%\tmp4e8c\0x040a.ini
- %TEMP%\tmp4e8c\0x040c.ini
- %TEMP%\tmp4e8c\setup.inx
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_x86_20210720061235.log
Deletes the following files
- %TEMP%\tmp4e8c.tmp
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\thm.xml
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\thm.wxl
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\logo.png
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\license.rtf
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\wixstdba.dll
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\thm.xml
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\thm.wxl
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\logo.png
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\license.rtf
- %TEMP%\{615bc16d-60f5-482e-91b3-b51d8130963b}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\wixstdba.dll
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\thm.xml
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\thm.wxl
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\logo.png
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\license.rtf
- %TEMP%\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\.ba1\bootstrapperapplicationdata.xml
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\wixstdba.dll
- %TEMP%\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.be\vcredist_x86.exe
Moves the following files
- from %ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe to %TEMP%\delbd74.tmp
- from %ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe to %TEMP%\delbecc.tmp
Modifies the following files
- %ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\state.rsm
- %ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\state.rsm
Network activity
Connects to
- 'oc##.thawte.com':80
- 'cr#.#hawte.com':80
UDP
- DNS ASK oc##.thawte.com
- DNS ASK cr#.#hawte.com
- DNS ASK public-trust.com
Miscellaneous
Creates and executes the following
- '%TEMP%\tmp4e8c\vcredist_x86.exe' /q
- '%TEMP%\tmp4e8c\setup.exe'
- '%TEMP%\tmp4e8c\vcredist_x86.exe' /q -burn.unelevated BurnPipe.{13FC7F0F-B46F-453C-A503-E1C3E7086FD2} {B1D2F4E3-72BB-480F-B2FF-64E1580C0B76} 2816
