Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\setup.js
Modifies file system:
Creates the following files:
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_FSViewer.exe@1.0.0.0\x86_FSViewer.exe@1.0.0.0.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\Nullsoft.NSIS.exehead.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\X86_Nullsoft.NSIS.exehead@1.0.0.0.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_FSViewer.exe@1.0.0.0\FSViewer.exe.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\uninst.exe_0xd3e1e0ec1b3ca7afa8a76d1a805d911a.1.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_fsplugin07.dll@1.0.0.0\fsplugin07.dll.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_fsplugin07.dll@1.0.0.0\x86_fsplugin07.dll@1.0.0.0.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_Your.Application.Name.Here@1.0.0.0\x86_Your.Application.Name.Here@1.0.0.0.manifest.__tmp__
- %TEMP%\~DF9583.tmp
- %TEMP%\~DF95E8.tmp
- <LS_APPDATA>\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
- %TEMP%\FastStone Image Viewer\roaming\modified\@APPDATA@\FastStone\FSIV\FSViewer.db
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_Your.Application.Name.Here@1.0.0.0\Your.Application.Name.Here.manifest.__tmp__
- %TEMP%\FastStone Image Viewer\local\temp\@APPDATA@\FastStone\FSIV\FSViewer.db
- %TEMP%\FastStone Image Viewer\local\meta\@APPDATA@\FastStone\FSIV\FSViewer.db.__meta__.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\FSViewer.exe_0x233bc7f5de21a69a75381e530e1fbd13.1.manifest.__tmp__
- %TEMP%\FastStone Image Viewer\xsandbox.bin.__tmp__
- %TEMP%\FastStone Image Viewer\local\temp\@PROGRAMFILESX86@\FastStone Image Viewer\FSViewer.exe
- %TEMP%\FastStone Image Viewer\local\meta\@PROGRAMFILESX86@\FastStone Image Viewer\FSViewer.exe.__meta__.__tmp__
- %TEMP%\setup.js
- %TEMP%\aut1.tmp
- %TEMP%\Setup.exe
- %TEMP%\aut2.tmp
- %TEMP%\FastStone Image Viewer\local\stubexe\0x6BB58E697DAAA837\FSViewer.exe.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin06.dll_0xf4c4f19b0f5cdb91007f90b81ab35f6e.2.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin07.dll_0x68bcb38ec85873e1e84b9300403c3a73.1.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fssl.db_0xba702eef6ca7ab58f1a12ee00a9e609d.1.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin04.dll_0x06ee164ef8e992bd2462e08fd3298d3b.1.manifest.__tmp__
- %TEMP%\FastStone Image Viewer\local\stubexe\0x6BB58E697DAAA837\FSViewer.exe.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\EmailZipEXE.bin_0x350d7f37a91f16d2ed63471edd4dd684.1.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin03.dll_0xe0204c12fb26f062608e604534f7d7e4.1.manifest.__tmp__
Deletes the following files:
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
Moves the following files:
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_FSViewer.exe@1.0.0.0\x86_FSViewer.exe@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_FSViewer.exe@1.0.0.0\x86_FSViewer.exe@1.0.0.0.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\Nullsoft.NSIS.exehead.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\Nullsoft.NSIS.exehead.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\X86_Nullsoft.NSIS.exehead@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\X86_Nullsoft.NSIS.exehead@1.0.0.0\X86_Nullsoft.NSIS.exehead@1.0.0.0.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_fsplugin07.dll@1.0.0.0\fsplugin07.dll.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_fsplugin07.dll@1.0.0.0\fsplugin07.dll.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_fsplugin07.dll@1.0.0.0\x86_fsplugin07.dll@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_fsplugin07.dll@1.0.0.0\x86_fsplugin07.dll@1.0.0.0.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_FSViewer.exe@1.0.0.0\FSViewer.exe.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_FSViewer.exe@1.0.0.0\FSViewer.exe.manifest
- from %TEMP%\FastStone Image Viewer\local\meta\@APPDATA@\FastStone\FSIV\FSViewer.db.__meta__.__tmp__ to %TEMP%\FastStone Image Viewer\local\meta\@APPDATA@\FastStone\FSIV\FSViewer.db.__meta__
- from %TEMP%\FastStone Image Viewer\local\modified\@APPDATA@\FastStone\FSIV\FSViewer.db to %TEMP%\FastStone Image Viewer\roaming\modified\@APPDATA@\FastStone\FSIV\FSViewer.db
- from %TEMP%\FastStone Image Viewer\local\meta\@APPDATA@\FastStone\FSIV\FSViewer.db.__meta__ to %TEMP%\FastStone Image Viewer\roaming\meta\@APPDATA@\FastStone\FSIV\FSViewer.db.__meta__
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_Your.Application.Name.Here@1.0.0.0\x86_Your.Application.Name.Here@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_Your.Application.Name.Here@1.0.0.0\x86_Your.Application.Name.Here@1.0.0.0.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_Your.Application.Name.Here@1.0.0.0\Your.Application.Name.Here.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\x86_Your.Application.Name.Here@1.0.0.0\Your.Application.Name.Here.manifest
- from %TEMP%\FastStone Image Viewer\local\temp\@APPDATA@\FastStone\FSIV\FSViewer.db to %TEMP%\FastStone Image Viewer\local\modified\@APPDATA@\FastStone\FSIV\FSViewer.db
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\uninst.exe_0xd3e1e0ec1b3ca7afa8a76d1a805d911a.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\uninst.exe_0xd3e1e0ec1b3ca7afa8a76d1a805d911a.1.manifest
- from %TEMP%\FastStone Image Viewer\local\stubexe\0x6BB58E697DAAA837\FSViewer.exe.__tmp__ to %TEMP%\FastStone Image Viewer\local\stubexe\0x6BB58E697DAAA837\FSViewer.exe
- from %TEMP%\FastStone Image Viewer\local\stubexe\0x6BB58E697DAAA837\FSViewer.exe.manifest.__tmp__ to %TEMP%\FastStone Image Viewer\local\stubexe\0x6BB58E697DAAA837\FSViewer.exe.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\EmailZipEXE.bin_0x350d7f37a91f16d2ed63471edd4dd684.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\EmailZipEXE.bin_0x350d7f37a91f16d2ed63471edd4dd684.1.manifest
- from %TEMP%\FastStone Image Viewer\xsandbox.bin.__tmp__ to %TEMP%\FastStone Image Viewer\xsandbox.bin
- from %TEMP%\FastStone Image Viewer\local\temp\@PROGRAMFILESX86@\FastStone Image Viewer\FSViewer.exe to %TEMP%\FastStone Image Viewer\local\modified\@PROGRAMFILESX86@\FastStone Image Viewer\FSViewer.exe
- from %TEMP%\FastStone Image Viewer\local\meta\@PROGRAMFILESX86@\FastStone Image Viewer\FSViewer.exe.__meta__.__tmp__ to %TEMP%\FastStone Image Viewer\local\meta\@PROGRAMFILESX86@\FastStone Image Viewer\FSViewer.exe.__meta__
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin07.dll_0x68bcb38ec85873e1e84b9300403c3a73.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin07.dll_0x68bcb38ec85873e1e84b9300403c3a73.1.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fssl.db_0xba702eef6ca7ab58f1a12ee00a9e609d.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fssl.db_0xba702eef6ca7ab58f1a12ee00a9e609d.1.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\FSViewer.exe_0x233bc7f5de21a69a75381e530e1fbd13.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\FSViewer.exe_0x233bc7f5de21a69a75381e530e1fbd13.1.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin03.dll_0xe0204c12fb26f062608e604534f7d7e4.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin03.dll_0xe0204c12fb26f062608e604534f7d7e4.1.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin04.dll_0x06ee164ef8e992bd2462e08fd3298d3b.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin04.dll_0x06ee164ef8e992bd2462e08fd3298d3b.1.manifest
- from %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin06.dll_0xf4c4f19b0f5cdb91007f90b81ab35f6e.2.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0xC1673C3918E63AAA\sxs\Manifests\fsplugin06.dll_0xf4c4f19b0f5cdb91007f90b81ab35f6e.2.manifest
Network activity:
Connects to:
- 'st###.turbo.net':443
UDP:
- DNS ASK st###.turbo.net
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'GINA Logon'
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "%TEMP%\setup.js"
- '%TEMP%\FastStone Image Viewer\local\stubexe\0x6BB58E697DAAA837\FSViewer.exe'
- '%TEMP%\Setup.exe'
Executes the following:
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 30 /tn anydesk /tr "%TEMP%\setup.js
