Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /t /f /im KMService.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\keymng.cmd
- %TEMP%\rarsfx0\kmservice.exe
- %TEMP%\rarsfx0\kmsins.cmd
- %TEMP%\rarsfx0\ospp.vbs
- %TEMP%\rarsfx0\osppc.dll
- %TEMP%\rarsfx0\ospprearm.exe
- %TEMP%\rarsfx0\portqry.exe
- %TEMP%\rarsfx0\rearm.cmd
- %TEMP%\rarsfx0\rest.cmd
- %TEMP%\rarsfx0\service.inf
- %TEMP%\rarsfx0\slerror.xml
- %TEMP%\rarsfx0\srvany.exe
- %TEMP%\rarsfx0\start.cmd
- %TEMP%\rarsfx0\act.cmd
- %TEMP%\rarsfx0\activar.cmd
- %TEMP%\rarsfx0\autorun.apm
- %TEMP%\rarsfx0\autorun.exe
- %TEMP%\rarsfx0\chk.cmd
- %TEMP%\rarsfx0\choice.exe
- %TEMP%\rarsfx0\cscript.exe
- %TEMP%\rarsfx0\help.txt
- %TEMP%\rarsfx0\hidcon.exe
- %TEMP%\rarsfx0\hs_message.vbs
- %TEMP%\rarsfx0\instsrv.exe
- %TEMP%\rarsfx0\evoactivacion office2010\act.cmd
- %TEMP%\rarsfx0\evoactivacion office2010\activar.cmd
- %TEMP%\rarsfx0\evoactivacion office2010\autorun.apm
- %TEMP%\rarsfx0\evoactivacion office2010\autorun.exe
- %TEMP%\rarsfx0\evoactivacion office2010\chk.cmd
- %TEMP%\rarsfx0\evoactivacion office2010\choice.exe
- %TEMP%\rarsfx0\evoactivacion office2010\cscript.exe
- %TEMP%\rarsfx0\evoactivacion office2010\help.txt
- %TEMP%\rarsfx0\evoactivacion office2010\hidcon.exe
- %TEMP%\rarsfx0\evoactivacion office2010\hs_message.vbs
- %TEMP%\rarsfx0\evoactivacion office2010\instsrv.exe
- %TEMP%\rarsfx0\evoactivacion office2010\keymng.cmd
- %TEMP%\rarsfx0\evoactivacion office2010\kmservice.exe
- %TEMP%\rarsfx0\evoactivacion office2010\kmsins.cmd
- %TEMP%\rarsfx0\evoactivacion office2010\ospp.vbs
- %TEMP%\rarsfx0\evoactivacion office2010\osppc.dll
- %TEMP%\rarsfx0\evoactivacion office2010\ospprearm.exe
- %TEMP%\rarsfx0\evoactivacion office2010\portqry.exe
- %TEMP%\rarsfx0\evoactivacion office2010\rearm.cmd
- %TEMP%\rarsfx0\evoactivacion office2010\rest.cmd
- %TEMP%\rarsfx0\evoactivacion office2010\service.inf
- %TEMP%\rarsfx0\evoactivacion office2010\slerror.xml
- %TEMP%\rarsfx0\evoactivacion office2010\srvany.exe
- %TEMP%\rarsfx0\evoactivacion office2010\start.cmd
- %TEMP%\rarsfx0\favicon.ico
- nul
- %TEMP%\rarsfx0\check
Deletes the following files
- %TEMP%\rarsfx0\check
Network activity
Connects to
- 'localhost':1688
TCP
Other
- 'localhost':49180
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\portqry.exe' -n 127.0.0.1 -e 1688
- '%TEMP%\rarsfx0\kmservice.exe'
- '%TEMP%\rarsfx0\cscript.exe' ospp.vbs /remhst
- '%TEMP%\rarsfx0\cscript.exe' ospp.vbs /sethst:127.0.0.1
- '%TEMP%\rarsfx0\cscript.exe' ospp.vbs /act
- '%TEMP%\rarsfx0\cscript.exe' ospp.vbs /dstatus
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\Activar.cmd" "
- '%WINDIR%\syswow64\reg.exe' QUERY HKLM\SOFTWARE\Microsoft\Office
- '%WINDIR%\syswow64\find.exe' /i "14.0"
- '%WINDIR%\syswow64\findstr.exe' /i /r NOT.LISTENING
- '%WINDIR%\syswow64\net.exe' start osppsvc
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%TEMP%\rarsfx0\kmservice.exe"
- '%WINDIR%\syswow64\net1.exe' start osppsvc
- '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\59a52881-a989-479d-af46-f275c6370663" /f
- '%WINDIR%\syswow64\find.exe' /i "0xC004F074"
- '%WINDIR%\syswow64\ping.exe' -n 2 localhost
- '%WINDIR%\syswow64\findstr.exe' /l "<Product activation successful>" check
- '%WINDIR%\syswow64\reg.exe' QUERY "HKLM\SYSTEM\CurrentControlSet\Services\KMService" /v DisplayName
- '%WINDIR%\syswow64\findstr.exe' /i KMService
- '%WINDIR%\syswow64\tasklist.exe' /fi "imagename eq KMService.exe"
- '%WINDIR%\syswow64\find.exe' /i /n "KMService.exe"
