Technical Information
Malicious functions
Creates and executes the following
- '<Full path to file>' (downloaded from the Internet)
Modifies file system
Creates the following files
- %TEMP%\svchost.exe
- %TEMP%\{ed073f11-dd9b-47d3-9f82-2f55b247693a}\x64\de-de.mst
- %TEMP%\{ed073f11-dd9b-47d3-9f82-2f55b247693a}\x64\midiplus_studio_v5.60.0_2023-07-25.msi
- %TEMP%\{ed073f11-dd9b-47d3-9f82-2f55b247693a}\x86\de-de.mst
- %TEMP%\{ed073f11-dd9b-47d3-9f82-2f55b247693a}\x86\midiplus_studio_v5.60.0_2023-07-25.msi
- %TEMP%\tusbaudio_installer.log
- %TEMP%\msif3e6.tmp
- %TEMP%\msif8e8.tmp
- %TEMP%\msif9f3.tmp
- %TEMP%\msifa71.tmp
- %TEMP%\msifacf.tmp
- %TEMP%\{e8c2d99f-d064-4147-99d9-aebf262c8b1f}\tlsetupfx.exe
- %TEMP%\msifb8c.tmp
- %TEMP%\{e8c2d99f-d064-4147-99d9-aebf262c8b1f}\pckty4ggqcoqeq\x64\tlsetupfx_apps.xml
- %TEMP%\{e8c2d99f-d064-4147-99d9-aebf262c8b1f}\pckty4ggqcoqeq\x64\tlsetupfx_drv.xml
- %TEMP%\{e8c2d99f-d064-4147-99d9-aebf262c8b1f}\pckty4ggqcoqeq\x64\tlsetupfx_main.xml
- %TEMP%\msife4c.tmp
- %TEMP%\{e8c2d99f-d064-4147-99d9-aebf262c8b1f}\tlsetupaddon.exe
- %TEMP%\msi15a.tmp
- %TEMP%\tlsetupfx.log
- %TEMP%\msi88f.tmp
- %TEMP%\msif66.tmp
Network activity
Connects to
- 'vi#.#23pan.cn':443
- 'oc##.#igicert.cn':80
- 'st####.rapidssl.com':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8e##############
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA%2FgMquETQMxBsUMjhPIsGg%3D
- http://st####.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJiUKgT2m88fZ4nxc1Lu6M%2FjvkagQUDNtsgkkPSmcKuBTuesRIUojrVjgCEAd4V2iV2b3G0kATGz4UOAg%3D
Other
- 'vi#.#23pan.cn':443
UDP
- DNS ASK vi#.#23pan.cn
- DNS ASK oc##.#igicert.cn
- DNS ASK st####.rapidssl.com
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost.exe'
- '%TEMP%\{e8c2d99f-d064-4147-99d9-aebf262c8b1f}\tlsetupfx.exe' task IsCurrentSystemSupported --cfg "%TEMP%\{E8C2D99F-D064-4147-99D9-AEBF262C8B1F}\pckty4GgQcoqEq\x64\tlsetupfx_main.xml" --logfile "%TEMP%\tlsetupfx.log" -v
- '%TEMP%\{e8c2d99f-d064-4147-99d9-aebf262c8b1f}\tlsetupfx.exe' task CheckRequirementsToStart --cfg "%TEMP%\{E8C2D99F-D064-4147-99D9-AEBF262C8B1F}\pckty4GgQcoqEq\x64\tlsetupfx_main.xml" --logfile "%TEMP%\tlsetupfx.log" --target "%TEMP%\{E8C2D99F-D064-4147-9...
Executes the following
- '<SYSTEM32>\msiexec.exe' /i "x64\Midiplus_Studio_v5.60.0_2023-07-25.msi" /l*v "%TEMP%\tusbaudio_installer.log"
- '%TEMP%\{e8c2d99f-d064-4147-99d9-aebf262c8b1f}\tlsetupfx.exe' task IsCurrentSystemSupported --cfg "%TEMP%\{E8C2D99F-D064-4147-99D9-AEBF262C8B1F}\pckty4GgQcoqEq\x64\tlsetupfx_main.xml" --logfile "%TEMP%\tlsetupfx.log" -v' (with hidden window)
- '%TEMP%\{e8c2d99f-d064-4147-99d9-aebf262c8b1f}\tlsetupfx.exe' task CheckRequirementsToStart --cfg "%TEMP%\{E8C2D99F-D064-4147-99D9-AEBF262C8B1F}\pckty4GgQcoqEq\x64\tlsetupfx_main.xml" --logfile "%TEMP%\tlsetupfx.log" --target "%TEMP%\{E8C2D99F-D064-4147-9...' (with hidden window)
