Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\MicrosoftComponent] 'ImagePath' = '%ProgramFiles%\MicrosoftComponent\Microsoft Component.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\MicrosoftComponent] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- %WINDIR%\Temp\n3igtxrk.out
- %WINDIR%\Temp\CSC1.tmp
- %WINDIR%\Temp\n3igtxrk.cmdline
- %ProgramFiles%\MicrosoftComponent\lasStaL
- %WINDIR%\Temp\n3igtxrk.0.cs
- %ProgramFiles%\MicrosoftComponent\lasudf
- %ProgramFiles%\MicrosoftComponent\lasRptL
- %ProgramFiles%\MicrosoftComponent\lasUtm
- %WINDIR%\Temp\RES2.tmp
- %WINDIR%\Temp\n3igtxrk.dll
- %ProgramFiles%\MicrosoftComponent\linsta
- %ProgramFiles%\MicrosoftComponent\nr
- %ProgramFiles%\MicrosoftComponent\MsComdll.dll
- <Current directory>\HdSn
- <Current directory>\sn.ssprt
- %ProgramFiles%\MicrosoftComponent\lasMngat
- %ProgramFiles%\MsSupport\MsComponent.ssprt
- %ProgramFiles%\MicrosoftComponent\20180316
- %ProgramFiles%\MicrosoftComponent\ns
- %ProgramFiles%\MicrosoftComponent\Microsoft Component.exe
Deletes the following files:
- %WINDIR%\Temp\n3igtxrk.cmdline
- %WINDIR%\Temp\n3igtxrk.0.cs
- %ProgramFiles%\MicrosoftComponent\MsComdll.dll
- %WINDIR%\Temp\n3igtxrk.dll
- %WINDIR%\Temp\n3igtxrk.out
- <Current directory>\HdSn
- <Current directory>\sn.ssprt
- %WINDIR%\Temp\CSC1.tmp
- %WINDIR%\Temp\RES2.tmp
Substitutes the following files:
- %ProgramFiles%\MicrosoftComponent\MsComdll.dll
- <Current directory>\sn.ssprt
- <Current directory>\HdSn
Network activity:
Connects to:
- 'te######lserver01.ddns.net':6660
- 'wp#d':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK te######lserver01.ddns.net
- DNS ASK wp#d
Miscellaneous:
Creates and executes the following:
- '%ProgramFiles%\MicrosoftComponent\Microsoft Component.exe'
- '<Current directory>\sn.ssprt' 1
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES2.tmp" "%WINDIR%\Temp\CSC1.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\n3igtxrk.cmdline"
- '<SYSTEM32>\sc.exe' create MicrosoftComponent start= auto binPath= "%ProgramFiles%\MicrosoftComponent\Microsoft Component.exe" DisplayName= "Microsoft Component"
