Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Security thread.exe' = '%WINDIR%\\Security thread.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\adb.url
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ToDesk_Service] 'ImagePath' = '"%TEMP%\ToDesk_Lite.exe" server_start'
Creates the following services
- 'ToDesk_Service' "%TEMP%\ToDesk_Lite.exe" server_start
Modifies file system
Creates the following files
- %TEMP%\todesk_lite.exe
- %TEMP%\13403a.tmp
- %TEMP%\133707.tmp
- %TEMP%\13254b.tmp
- %TEMP%\131c75.tmp
- %TEMP%\130e04.tmp
- %TEMP%\1306b4.tmp
- %TEMP%\12fb6e.tmp
- %TEMP%\12eb67.tmp
- %TEMP%\12e050.tmp
- %TEMP%\12d49d.tmp
- %TEMP%\12c7ff.tmp
- %TEMP%\12be6e.tmp
- %TEMP%\12b183.tmp
- %TEMP%\12a3ec.tmp
- %TEMP%\129829.tmp
- %TEMP%\128b8c.tmp
- %TEMP%\128249.tmp
- %TEMP%\127177.tmp
- %TEMP%\12644e.tmp
- %ALLUSERSPROFILE%\todesk_lite\config.ini
- %WINDIR%\security.vbs
- %TEMP%\124c2c.tmp
- %ALLUSERSPROFILE%\todesk_lite\logs\service_2022_06_17.log
- %TEMP%\1239b5.tmp
- <Current directory>\security.vbs
- %TEMP%\122d28.tmp
- %WINDIR%\security thread.exe
- %TEMP%\1355ec.tmp
- %TEMP%\13600a.tmp
Sets the 'hidden' attribute to the following files
- %TEMP%\122d28.tmp
- %TEMP%\13403a.tmp
- %TEMP%\133707.tmp
- %TEMP%\13254b.tmp
- %TEMP%\131c75.tmp
- %TEMP%\130e04.tmp
- %TEMP%\1306b4.tmp
- %TEMP%\12fb6e.tmp
- %TEMP%\12eb67.tmp
- %TEMP%\12e050.tmp
- %TEMP%\12d49d.tmp
- %TEMP%\12c7ff.tmp
- %TEMP%\1355ec.tmp
- %TEMP%\12be6e.tmp
- %TEMP%\12a3ec.tmp
- %TEMP%\129829.tmp
- %TEMP%\128b8c.tmp
- %TEMP%\128249.tmp
- %TEMP%\127177.tmp
- %TEMP%\12644e.tmp
- %WINDIR%\security.vbs
- %TEMP%\124c2c.tmp
- %TEMP%\1239b5.tmp
- <Current directory>\security.vbs
- %APPDATA%\microsoft\windows\start menu\programs\startup\adb.url
- %TEMP%\12b183.tmp
- %TEMP%\13600a.tmp
Deletes the following files
- %WINDIR%\security thread.exe
Network activity
Connects to
- 'localhost':35600
- 'au####.todesk.com':443
TCP
Other
- 'localhost':35600
- 'au####.todesk.com':443
UDP
- DNS ASK au####.todesk.com
Miscellaneous
Creates and executes the following
- '%TEMP%\todesk_lite.exe'
- '%WINDIR%\security thread.exe'
- '%TEMP%\todesk_lite.exe' server_start
- '%WINDIR%\syswow64\wscript.exe' "<Current directory>\Security.vbs"
- '%TEMP%\todesk_lite.exe' clinet_hide
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\Security.vbs"
- '%WINDIR%\security thread.exe' ' (with hidden window)
