Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
Modifies file system
Creates the following files
- %TEMP%\is-227n5.tmp\<File name>.tmp
- %TEMP%\is-6ntaq.tmp\_isetup\_setup64.tmp
- %TEMP%\is-idd1t.tmp\<File name>.tmp
- %TEMP%\is-rbv3i.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\reclosable\is-60l26.tmp
- %LOCALAPPDATA%\reclosable\is-2rt5i.tmp
- %LOCALAPPDATA%\reclosable\is-1ph9o.tmp
- %LOCALAPPDATA%\reclosable\is-ojnus.tmp
- %LOCALAPPDATA%\reclosable\unins000.dat
- %ALLUSERSPROFILE%\ujethmpe.a3x
- nul
Deletes the following files
- %TEMP%\is-6ntaq.tmp\_isetup\_setup64.tmp
- %TEMP%\is-227n5.tmp\<File name>.tmp
- %TEMP%\is-rbv3i.tmp\_isetup\_setup64.tmp
- %TEMP%\is-idd1t.tmp\<File name>.tmp
- %ALLUSERSPROFILE%\ujethmpe.a3x
Moves the following files
- from %LOCALAPPDATA%\reclosable\is-60l26.tmp to %LOCALAPPDATA%\reclosable\unins000.exe
- from %LOCALAPPDATA%\reclosable\is-2rt5i.tmp to %LOCALAPPDATA%\reclosable\file.exe
- from %LOCALAPPDATA%\reclosable\is-1ph9o.tmp to %LOCALAPPDATA%\reclosable\pranks.vsdx
- from %LOCALAPPDATA%\reclosable\is-ojnus.tmp to %LOCALAPPDATA%\reclosable\pranks1.a3x
Miscellaneous
Creates and executes the following
- '%TEMP%\is-227n5.tmp\<File name>.tmp' /SL5="$5024A,1781144,812544,<Full path to file>"
- '%TEMP%\is-idd1t.tmp\<File name>.tmp' /SL5="$70190,1781144,812544,<Full path to file>" /VERYSILENT
- '%LOCALAPPDATA%\reclosable\file.exe' "%LOCALAPPDATA%\reclosable\\pranks1.a3x"
- '%LOCALAPPDATA%\reclosable\file.exe' %ALLUSERSPROFILE%\\UJETHMpe.a3x
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
- '<SYSTEM32>\find.exe' /I "nswscsvc.exe"
- '<SYSTEM32>\find.exe' /I "avgui.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "sophoshealth.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 >nul && file.exe %ALLUSERSPROFILE%\\UJETHMpe.a3x && del %ALLUSERSPROFILE%\\UJETHMpe.a3x
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
- '%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
- '<SYSTEM32>\find.exe' /I "avastui.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "wrsa.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
- '<SYSTEM32>\find.exe' /I "opssvc.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1 >nul && file.exe %ALLUSERSPROFILE%\\UJETHMpe.a3x && del %ALLUSERSPROFILE%\\UJETHMpe.a3x' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"' (with hidden window)
