Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' -F -IM activeuc.exe
- '%WINDIR%\syswow64\taskkill.exe' -F -IM activeMeeting.exe
Modifies file system
Creates the following files
- %TEMP%\is-vfgpm.tmp\<File name>.tmp
- D:\384a8e9412f801c052\install.res.1042.dll
- D:\384a8e9412f801c052\install.res.1041.dll
- D:\384a8e9412f801c052\install.res.1040.dll
- D:\384a8e9412f801c052\install.res.1036.dll
- D:\384a8e9412f801c052\install.res.3082.dll
- D:\384a8e9412f801c052\install.res.1031.dll
- D:\384a8e9412f801c052\install.res.1028.dll
- D:\384a8e9412f801c052\install.res.2052.dll
- D:\384a8e9412f801c052\eula.1033.txt
- D:\384a8e9412f801c052\eula.1041.txt
- D:\384a8e9412f801c052\$shtdwn$.req
- D:\384a8e9412f801c052\eula.1040.txt
- D:\384a8e9412f801c052\eula.1036.txt
- D:\384a8e9412f801c052\eula.3082.txt
- D:\384a8e9412f801c052\eula.1031.txt
- D:\384a8e9412f801c052\eula.1028.txt
- D:\384a8e9412f801c052\eula.2052.txt
- D:\384a8e9412f801c052\globdata.ini
- D:\384a8e9412f801c052\install.ini
- D:\384a8e9412f801c052\vcredist.bmp
- D:\384a8e9412f801c052\install.res.1033.dll
- D:\384a8e9412f801c052\eula.1042.txt
- D:\384a8e9412f801c052\install.exe
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\is-httqg.tmp
- %TEMP%\is-sivh2.tmp\_isetup\_regdll.tmp
- %TEMP%\is-sivh2.tmp\_isetup\_setup64.tmp
- %TEMP%\is-sivh2.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-b9asu.tmp\<File name>.tmp
- %TEMP%\is-papoh.tmp\_isetup\_regdll.tmp
- %TEMP%\is-papoh.tmp\_isetup\_setup64.tmp
- %TEMP%\is-papoh.tmp\_isetup\_shfoldr.dll
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\is-a99ms.tmp
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\is-nj97o.tmp
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-5kvfd.tmp
- D:\384a8e9412f801c052\vc_red.cab
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-uglc8.tmp
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-g1f1n.tmp
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-n2k78.tmp
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-ace64.tmp
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-isogp.tmp
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-22unc.tmp
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-t22eg.tmp
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-dskhd.tmp
- %ProgramFiles(x86)%\iactive\activecenter\liveuc\unins000.dat
- D:\384a8e9412f801c052\vc_red.msi
- %TEMP%\dd_vcredistui0208.txt
Deletes the following files
- %TEMP%\is-sivh2.tmp\_isetup\_regdll.tmp
- %TEMP%\is-sivh2.tmp\_isetup\_setup64.tmp
- %TEMP%\is-sivh2.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-vfgpm.tmp\<File name>.tmp
Moves the following files
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\is-a99ms.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\unins000.exe
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\is-nj97o.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\iah323dll.dll
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\is-httqg.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\vc2008_redist_x86_setup.exe
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-5kvfd.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\avcodec-52.dll
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-uglc8.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\avutil-49.dll
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-g1f1n.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\datacb.ini
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-n2k78.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\easyg7231_pwplugin.dll
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-ace64.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\h261vic_ptplugin.dll
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-isogp.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\h263-1998_ptplugin.dll
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-22unc.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\h264_x264_ptplugin.dll
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-t22eg.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\libx264-102.dll
- from %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\is-dskhd.tmp to %ProgramFiles(x86)%\iactive\activecenter\liveuc\h323plugin\x264plugin_helper.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-vfgpm.tmp\<File name>.tmp' /SL5="$6024C,3451681,51712,<Full path to file>"
- '%TEMP%\is-b9asu.tmp\<File name>.tmp' /SL5="$A014A,3451681,51712,<Full path to file>" /sp- /norestart
- '%ProgramFiles(x86)%\iactive\activecenter\liveuc\vc2008_redist_x86_setup.exe'
- 'D:\384a8e9412f801c052\install.exe'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""<Full path to file>"" /sp- /norestart
- '%WINDIR%\syswow64\cmd.exe' /c ""<Full path to file>"" /sp- /norestart' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' -F -IM activeuc.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' -F -IM activeMeeting.exe' (with hidden window)
