Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\dllhost.exe' /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
- '%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe' /bootstrapu
- '<SYSTEM32>\msdtc.exe'
- '%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe' -u
- '<SYSTEM32>\wbem\mofcomp.exe' "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet.mof.uninstall"
- '<SYSTEM32>\msiexec.exe' -Embedding DC18DF15A957B199539F1703E12581F8 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' /x "{E78BFA60-5393-4C38-82AB-E8019E464EB4}" /Liemo!+ "%PROGRAM_FILES%\T-Systems\Logs\Microsoft .NET Framework 1.1 Multilanguage Pack DE.log" REBOOT=ReallySuppress /qb-
- '<SYSTEM32>\cscript.exe' CheckInstalled.vbs {E78BFA60-5393-4C38-82AB-E8019E464EB4}
- '<SYSTEM32>\msiexec.exe' -Embedding 0546D9DB0FA4B7E95127D971F4D7222E
- '<SYSTEM32>\msiexec.exe' /x "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" /Liemo!+ "%PROGRAM_FILES%\T-Systems\Logs\Microsoft .NET Framework 1.1.4322_SP1 EN-ML.log" /qb- REBOOT=ReallySuppress
Modifies file system :
Creates the following files:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI5.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI6.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %WINDIR%\Installer\MSI4.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\Config.Msi\2c319.rbs
- <SYSTEM32>\PerfStringBackup.TMP
- %TEMP%\ASPNETSetup.log
- %TEMP%\RGID.tmp
- C:\Config.Msi\2c31b.rbf
- C:\Config.Msi\2c31a.rbf
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{F356C106-7598-4D53-8A6E-A3BE3F01E70A}.crmlog
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Registration\_RegDBWrt.clb
- %TEMP%\tmpB.tmp
- %WINDIR%\Installer\MSIA.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %PROGRAM_FILES%\T-Systems\Logs\Microsoft .NET Framework 1.1 Multilanguage Pack DE.log
- %TEMP%\GLC1.tmp
- %TEMP%\~GLH0000.TMP
- %WINDIR%\Installer\MSI3.tmp
- %PROGRAM_FILES%\T-Systems\Logs\Microsoft .NET Framework 1.1.4322_SP1 EN-ML.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- %TEMP%\~DFE529.tmp
- %WINDIR%\Installer\2c318.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
Sets the 'hidden' attribute to the following files:
- C:\Config.Msi\2c31c.rbf
- C:\Config.Msi\2c31d.rbf
- C:\Config.Msi\2c31a.rbf
- C:\Config.Msi\2c31b.rbf
Deletes the following files:
- %TEMP%\tmpB.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\enterprisesec.config.cch.3168.218406
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSIC.tmp
- %TEMP%\RGID.tmp
- <SYSTEM32>\PerfStringBackup.TMP
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\security.config.cch.3168.218390
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\CheckInstalled.vbs
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Registration\R000000000007.clb
- %WINDIR%\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{BF4C4D5C-6924-41E8-9BF1-DCC37DF6F31D}.crmlog
- %WINDIR%\Installer\MSI7.tmp
Moves the following system files:
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe to C:\Config.Msi\2c348.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\vbc7ui.dll to C:\Config.Msi\2c349.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe to C:\Config.Msi\2c346.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll to C:\Config.Msi\2c347.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\msvcr71.dll to C:\Config.Msi\2c34c.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualC.Dll to C:\Config.Msi\2c34d.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll to C:\Config.Msi\2c34a.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe.config to C:\Config.Msi\2c34b.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\cscomp.dll to C:\Config.Msi\2c340.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe to C:\Config.Msi\2c341.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe.config to C:\Config.Msi\2c33e.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.rsp to C:\Config.Msi\2c33f.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe to C:\Config.Msi\2c344.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe.config to C:\Config.Msi\2c345.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\cscompmgd.dll to C:\Config.Msi\2c342.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\cscompui.dll to C:\Config.Msi\2c343.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\diasymreader.dll to C:\Config.Msi\2c34e.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_perf.ini to C:\Config.Msi\2c359.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_perf.h to C:\Config.Msi\2c35a.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.js to C:\Config.Msi\2c357.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.htm to C:\Config.Msi\2c358.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallSqlState.sql to C:\Config.Msi\2c35d.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallPersistSqlState.sql to C:\Config.Msi\2c35e.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet.mof to C:\Config.Msi\2c35b.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet.config to C:\Config.Msi\2c35c.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe.config to C:\Config.Msi\2c351.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe.config to C:\Config.Msi\2c352.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ndpsetup.ico to C:\Config.Msi\2c34f.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ieexec.exe.config to C:\Config.Msi\2c350.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll to C:\Config.Msi\2c355.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\fusion.dll to C:\Config.Msi\2c356.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf to C:\Config.Msi\2c353.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll to C:\Config.Msi\2c354.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\alinkui.dll to C:\Config.Msi\2c33d.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_b50667e9\__AssemblyInfo__.ini to C:\Config.Msi\2c326.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_5917eb5b\mscorlib.dll to C:\Config.Msi\2c327.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_minimaltrust.config to C:\Config.Msi\2c324.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_b50667e9\CustomMarshalers.dll to C:\Config.Msi\2c325.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_27b9fd4f\__AssemblyInfo__.ini to C:\Config.Msi\2c32a.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_cd264933\System.Design.dll to C:\Config.Msi\2c32b.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_5917eb5b\__AssemblyInfo__.ini to C:\Config.Msi\2c328.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_27b9fd4f\System.dll to C:\Config.Msi\2c329.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\enterprisesec.config to C:\Config.Msi\2c31e.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\machine.config to C:\Config.Msi\2c31f.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\security.config.cch to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\security.config.cch.3168.218390
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\enterprisesec.config.cch to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\enterprisesec.config.cch.3168.218406
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_lowtrust.config to C:\Config.Msi\2c322.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_mediumtrust.config to C:\Config.Msi\2c323.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\security.config to C:\Config.Msi\2c320.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\web_hightrust.config to C:\Config.Msi\2c321.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_cd264933\__AssemblyInfo__.ini to C:\Config.Msi\2c32c.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.dll to C:\Config.Msi\2c337.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.Vsa.dll to C:\Config.Msi\2c338.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.Vb.CodeDOMProcessor.dll to C:\Config.Msi\2c335.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft_VsaVb.dll to C:\Config.Msi\2c336.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\Vsavb7rtUI.dll to C:\Config.Msi\2c33b.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\alink.dll to C:\Config.Msi\2c33c.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll to C:\Config.Msi\2c339.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\vsavb7.olb to C:\Config.Msi\2c33a.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_7cac80ba\System.Drawing.Design.dll to C:\Config.Msi\2c32f.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_7cac80ba\__AssemblyInfo__.ini to C:\Config.Msi\2c330.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_c34133cb\System.Drawing.dll to C:\Config.Msi\2c32d.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_c34133cb\__AssemblyInfo__.ini to C:\Config.Msi\2c32e.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_f236c56a\System.Xml.dll to C:\Config.Msi\2c333.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_f236c56a\__AssemblyInfo__.ini to C:\Config.Msi\2c334.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_353815cd\System.Windows.Forms.dll to C:\Config.Msi\2c331.rbf
- from %WINDIR%\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_353815cd\__AssemblyInfo__.ini to C:\Config.Msi\2c332.rbf
Moves the following files:
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\enterprisesec.config.cch to C:\Config.Msi\2c31c.rbf
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\security.config.cch to C:\Config.Msi\2c31d.rbf
- from %TEMP%\~GLH0000.TMP to %TEMP%\CheckInstalled.vbs
- from %WINDIR%\Registration\_RegDBWrt.clb to %WINDIR%\Registration\R00000000000c.clb
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
