Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Olivers Digital Lock] 'ImagePath' = '"%ProgramFiles%\Olivers Digital Lock\olivers_digital_lock_service.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\Olivers Digital Lock] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- %ProgramFiles%\Olivers Digital Lock\uninstall.exe
- %ProgramFiles%\Olivers Digital Lock\tap\cert\OpenVPNTech-2.cer
- %ALLUSERSPROFILE%\Start Menu\Programs\Olivers Digital Lock\Oliver's Digital Lock.lnk
- %ALLUSERSPROFILE%\Desktop\Oliver's Digital Lock.lnk
- %ProgramFiles%\Olivers Digital Lock\tap\tap0901.cat
- %ProgramFiles%\Olivers Digital Lock\tap\OemVista.inf
- %ProgramFiles%\Olivers Digital Lock\tap\cert\OpenVPNTech-1.cer
- %ProgramFiles%\Olivers Digital Lock\tap\tap0901.sys
- %TEMP%\nsk2.tmp\ns6.tmp
- %TEMP%\nsk2.tmp\ns5.tmp
- %TEMP%\nsk2.tmp\AccessControl.dll
- %TEMP%\nsk2.tmp\ns7.tmp
- %TEMP%\nsk2.tmp\nsExec.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Olivers Digital Lock\Uninstall.lnk
- %TEMP%\nsk2.tmp\ns4.tmp
- %TEMP%\nsk2.tmp\ns3.tmp
- %ProgramFiles%\Olivers Digital Lock\Newtonsoft.Json.dll
- %ProgramFiles%\Olivers Digital Lock\json-c.lib
- %ProgramFiles%\Olivers Digital Lock\vcruntime140.dll
- %ProgramFiles%\Olivers Digital Lock\appicon.ico
- %ProgramFiles%\Olivers Digital Lock\olivers_digital_lock.exe
- %TEMP%\nsk2.tmp\SimpleSC.dll
- %ProgramFiles%\Olivers Digital Lock\olivers_digital_lock_service.exe
- %ProgramFiles%\Olivers Digital Lock\olivers_digital_lock_core.exe
- %ProgramFiles%\Olivers Digital Lock\ssleay32.dll
- %ProgramFiles%\Olivers Digital Lock\liblzo2-2.dll
- %ProgramFiles%\Olivers Digital Lock\tap\tapinstall.exe
- %ProgramFiles%\Olivers Digital Lock\libpkcs11-helper-1.dll
- %ProgramFiles%\Olivers Digital Lock\libcurl.lib
- %ProgramFiles%\Olivers Digital Lock\libcurl.dll
- %ProgramFiles%\Olivers Digital Lock\libeay32.dll
- %ProgramFiles%\Olivers Digital Lock\openvpn.exe
Deletes the following files:
- %TEMP%\nsk2.tmp\ns6.tmp
- %TEMP%\nsk2.tmp\ns7.tmp
- %TEMP%\nsk2.tmp\ns5.tmp
- %TEMP%\nsk2.tmp\ns3.tmp
- %TEMP%\nsk2.tmp\ns4.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'msctls_progress32' WindowName: ''
- ClassName: '#32770' WindowName: ''
Creates and executes the following:
- '%TEMP%\nsk2.tmp\ns6.tmp' "%ProgramFiles%\Olivers Digital Lock\tap\tapinstall.exe" update "%ProgramFiles%\Olivers Digital Lock\tap\OemVista.inf" tap0901
- '%TEMP%\nsk2.tmp\ns7.tmp' "%ProgramFiles%\Olivers Digital Lock\tap\tapinstall.exe" install "%ProgramFiles%\Olivers Digital Lock\tap\OemVista.inf" tap0901
- '%TEMP%\nsk2.tmp\ns5.tmp' certutil -addstore -f "TrustedPublisher" "%ProgramFiles%\Olivers Digital Lock\tap\cert\OpenVPNTech-2.cer"
- '%TEMP%\nsk2.tmp\ns3.tmp' sc sdset "Olivers Digital Lock" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRCRPWP;;;IU)(A;;CCLCSWLOCRRC;;;SU)
- '%TEMP%\nsk2.tmp\ns4.tmp' certutil -addstore -f "TrustedPublisher" "%ProgramFiles%\Olivers Digital Lock\tap\cert\OpenVPNTech-1.cer"
Executes the following:
- '<SYSTEM32>\sc.exe' sdset "Olivers Digital Lock" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRCRPWP;;;IU)(A;;CCLCSWLOCRRC;;;SU)
