Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\pcCMService] 'ImagePath' = '"%CommonProgramFiles(x86)%\Motive\pcCMService.exe"'
- [HKLM\System\CurrentControlSet\Services\pcCMService] 'Start' = '00000002'
Creates the following services
- 'pcCMService' "%CommonProgramFiles(x86)%\Motive\pcCMService.exe"
- 'pcCMService' %CommonProgramFiles(x86)%\Motive\pcCMService.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM McciControlHost.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM pcControlHost.exe
Modifies file system
Creates the following files
- %TEMP%\nszf4da.tmp
- %CommonProgramFiles(x86)%\motive\pcutilsx.dll
- %TEMP%\pcutilsx.dll
- %CommonProgramFiles(x86)%\motive\pcsysx.dll
- %TEMP%\pcsysx.dll
- %CommonProgramFiles(x86)%\motive\pcsmx.dll
- %TEMP%\pcsmx.dll
- %CommonProgramFiles(x86)%\motive\pchttpx.dll
- %TEMP%\pchttpx.dll
- %CommonProgramFiles(x86)%\motive\pceventx.dll
- %TEMP%\pceventx.dll
- %CommonProgramFiles(x86)%\motive\pccontrolhost.exe
- %TEMP%\pccontrolhost.exe
- %CommonProgramFiles(x86)%\motive\pclogx.dll
- %TEMP%\pclogx.dll
- %CommonProgramFiles(x86)%\motive\pccmservice.exe
- %TEMP%\pccmservice.exe
- %CommonProgramFiles(x86)%\motive\installhelper.exe
- %TEMP%\installhelper.exe
- %TEMP%\nsef7b8.tmp\nsisplugin.dll
- %TEMP%\pcuacmanagerx.dll
- %CommonProgramFiles(x86)%\motive\pcuacmanagerx.dll
Deletes the following files
- %TEMP%\installhelper.exe
- %TEMP%\pccmservice.exe
- %TEMP%\pclogx.dll
- %TEMP%\pccontrolhost.exe
- %TEMP%\pceventx.dll
- %TEMP%\pchttpx.dll
- %TEMP%\pcsmx.dll
- %TEMP%\pcsysx.dll
- %TEMP%\pcutilsx.dll
- %TEMP%\pcuacmanagerx.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%CommonProgramFiles(x86)%\motive\pccontrolhost.exe' /RegServer
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /predefinedallaccess /platform=WIN32
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /addlegacy= /platform=WIN32
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /registercmservice /platform=WIN32
- '%CommonProgramFiles(x86)%\motive\pccmservice.exe' /Service
- '%CommonProgramFiles(x86)%\motive\installhelper.exe' /startcmservice /platform=WIN32
- '%CommonProgramFiles(x86)%\motive\pccmservice.exe'
- '%WINDIR%\syswow64\taskkill.exe' /F /IM McciControlHost.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM pcControlHost.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\pcLogX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\pcEventX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\pcHTTPX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\pcSMX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\pcSysX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\pcUtilsX.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles(x86)%\Motive\pcUACManagerX.dll"
