Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ACTDataCollector] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ACTDataCollector] 'ImagePath' = '"%ProgramFiles%\Microsoft Agent Framework\Agent Framework\actdcsvc.exe"'
Modifies file system:
Creates the following files:
- %TEMP%\IXP000.TMP\AFSetup.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\UacceTransform.xsl
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\UacceLoggingRules.xml
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\uacce.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\GSZ\DirectiveFile.xml
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\GSZ\regread.dll
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\GSZ\GinaTransform.xsl
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\GSZ\ginasession0.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\win2kagents.sdb
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\gmeserv.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\sdbinst.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\mastershim.dll
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\uacce.sdb
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\depdetct.dll
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\DepManifest.csv
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\DepTransform.xsl
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\DepLoggingRules.xml
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\dep.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Data\config.xml
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Data\install.xml
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\msxml6.msi
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\AgentFramework.msi
- %WINDIR%\Installer\2898e.msi
- %ProgramFiles%\Microsoft Agent Framework\Shared\VistaEventParse.dll
- %ProgramFiles%\Microsoft Agent Framework\Shared\EventParse.dll
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\dep.sdb
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\uacdetct.dll
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\logger.dll
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\mastershim.dll
- C:\Documents and Settings\LocalService\Local Settings\Temp\_____6
- C:\Documents and Settings\LocalService\Local Settings\Temp\_____4
- C:\Documents and Settings\LocalService\Local Settings\Temp\_____2
- C:\Documents and Settings\LocalService\Local Settings\Temp\_____3
- %ALLUSERSPROFILE%\Application Data\Microsoft\Application Compatibility Toolkit 5\DataCollector\Status\STATUS-CRNJEUFU{43EFD5DD-B2E1-478D-95B4-490D242E3E78}.xml
- C:\Documents and Settings\LocalService\Favorites\Desktop.ini
- %ALLUSERSPROFILE%\Application Data\Microsoft\Application Compatibility Toolkit 5\DataCollector\Scratch\dep\DCETempLog.etl
- %WINDIR%\AppPatch\Custom\{f5d29c4e-70f8-4a22-9f30-43bcd5cedf7a}.sdb
- <SYSTEM32>\config\UACCEEve.evt
- <SYSTEM32>\logger.dll
- %WINDIR%\AppPatch\uacce.sdb
- %WINDIR%\AppPatch\uacdetct.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Application Compatibility Toolkit 5\DataCollector\Status\STATUS-CRNJEUFU{D400FF9C-CB06-4CA2-8413-DDED20AAD649}.xml
- %WINDIR%\AppPatch\Custom\{09d07d17-881f-4052-83c9-90cfe71e4ade}.sdb
- %WINDIR%\AppPatch\gmeserv.exe
- %WINDIR%\AppPatch\DepManifest.csv
- %WINDIR%\AppPatch\dep.sdb
- %WINDIR%\AppPatch\depdetct.dll
- %TEMP%\_remove.bat
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\AFSetup.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Application Compatibility Toolkit 5\DataCollector\Log\af.xml
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\win2kagents.sdb
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\envchange.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\gmeserv.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\sdbinst.exe
- %ProgramFiles%\Microsoft Agent Framework\Shared\afutil.dll
- C:\Documents and Settings\LocalService\Local Settings\Temp\_____5
- %ProgramFiles%\Microsoft Agent Framework\Shared\EventLogMonitor.dll
- %ProgramFiles%\Microsoft Agent Framework\Shared\acinv.dll
- %TEMP%\IXP000.TMP\logger.dll
- %TEMP%\IXP000.TMP\uacdetct.dll
- %TEMP%\IXP000.TMP\uacce.sdb
- %TEMP%\IXP000.TMP\UacceTransform.xsl
- %TEMP%\IXP000.TMP\UacceLoggingRules.xml
- %TEMP%\IXP000.TMP\uacce.exe
- %TEMP%\IXP000.TMP\DirectiveFile.xml
- %TEMP%\IXP000.TMP\regread.dll
- %TEMP%\IXP000.TMP\GinaTransform.xsl
- %TEMP%\IXP000.TMP\ginasession0.exe
- %TEMP%\IXP000.TMP\win2kagents.sdb
- %TEMP%\IXP000.TMP\envchange.exe
- %TEMP%\IXP000.TMP\gmeserv.exe
- %TEMP%\IXP000.TMP\mastershim.dll
- %TEMP%\IXP000.TMP\depdetct.dll
- %TEMP%\IXP000.TMP\dep.sdb
- %TEMP%\IXP000.TMP\DepManifest.csv
- %TEMP%\IXP000.TMP\DepTransform.xsl
- %TEMP%\IXP000.TMP\DepLoggingRules.xml
- %TEMP%\IXP000.TMP\dep.exe
- %TEMP%\IXP000.TMP\config.xml
- %TEMP%\IXP000.TMP\install.xml
- %TEMP%\IXP000.TMP\msxml6.msi
- %TEMP%\IXP000.TMP\AgentFramework.msi
- %TEMP%\IXP000.TMP\sdbinst.exe
- %WINDIR%\Installer\28989.msi
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI2.tmp
- %ProgramFiles%\Microsoft Agent Framework\Schemas\Object Framework\DCPStatus.xsd
- %ProgramFiles%\Microsoft Agent Framework\Schemas\Agent Framework\systemagent.xsd
- %ProgramFiles%\Microsoft Agent Framework\Schemas\Agent Framework\agent.xsd
- %ProgramFiles%\Microsoft Agent Framework\Schemas\Agent Framework\afconfig.xsd
- %ProgramFiles%\Microsoft Agent Framework\Schemas\Agent Framework\afinstall.xsd
- %ProgramFiles%\Microsoft Agent Framework\Schemas\Agent Framework\afglobal.xsd
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Uploader\UploaderAgent.xml
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Uploader\uploader.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Uploader\filecopy.dll
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Compressor\Cabtech.dll
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Compressor\CompressorAgent.xml
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Compressor\compressor.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Collector\collect.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Collector\CollectorAgent.xml
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Bucketizer\CollectorOutput.xsd
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Bucketizer\bucketizer.exe
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Bucketizer\BktOutputReverseTransform.xsl
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Bucketizer\BktOutputTransform.xsl
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Bucketizer\BucketizerAgent.xml
- %ProgramFiles%\Microsoft Agent Framework\Agent Framework\actdcsvc.exe
- C:\Config.Msi\2898d.rbs
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\2898c.ipi
- %WINDIR%\Installer\2898a.msi
- %WINDIR%\Installer\MSI3.tmp
- %ProgramFiles%\Microsoft Agent Framework\Shared\SysSpecData.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Application Compatibility Toolkit 5\DataCollector\Logging\AM-STATCOMP-{3BF5AAEF-847F-44b3-91DB-F8CC5E27D366}\STATUS-CRNJEUFU{D400FF9C-CB06-4CA2-8413...
Sets the 'hidden' attribute to the following files:
- C:\Documents and Settings\LocalService\Favorites\Desktop.ini
Deletes the following files:
- %WINDIR%\Installer\MSI1.tmp
- %TEMP%\IXP000.TMP\mastershim.dll
- %TEMP%\IXP000.TMP\depdetct.dll
- %TEMP%\IXP000.TMP\dep.sdb
- %TEMP%\IXP000.TMP\DepManifest.csv
- %TEMP%\IXP000.TMP\DepTransform.xsl
- %TEMP%\IXP000.TMP\DepLoggingRules.xml
- %TEMP%\IXP000.TMP\logger.dll
- %TEMP%\IXP000.TMP\dep.exe
- %TEMP%\IXP000.TMP\install.xml
- %TEMP%\IXP000.TMP\msxml6.msi
- %TEMP%\IXP000.TMP\AgentFramework.msi
- C:\Documents and Settings\LocalService\Local Settings\Temp\_____2
- C:\Documents and Settings\LocalService\Local Settings\Temp\_____3
- C:\Documents and Settings\LocalService\Local Settings\Temp\_____4
- %TEMP%\IXP000.TMP\gmeserv.exe
- %TEMP%\IXP000.TMP\sdbinst.exe
- %TEMP%\IXP000.TMP\win2kagents.sdb
- %TEMP%\IXP000.TMP\ginasession0.exe
- %TEMP%\IXP000.TMP\GinaTransform.xsl
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\28989.msi
- %WINDIR%\Installer\MSI4.tmp
- C:\Config.Msi\2898d.rbs
- %WINDIR%\Installer\2898a.msi
- %WINDIR%\Installer\2898c.ipi
- C:\Documents and Settings\LocalService\Local Settings\Temp\_____5
- %TEMP%\IXP000.TMP\config.xml
- %TEMP%\IXP000.TMP\envchange.exe
- %TEMP%\IXP000.TMP\uacce.sdb
- %TEMP%\IXP000.TMP\UacceTransform.xsl
- %TEMP%\IXP000.TMP\UacceLoggingRules.xml
- %TEMP%\IXP000.TMP\uacce.exe
- %TEMP%\IXP000.TMP\DirectiveFile.xml
- %TEMP%\IXP000.TMP\regread.dll
- %WINDIR%\Installer\MSI2.tmp
- %TEMP%\IXP000.TMP\uacdetct.dll
- C:\Documents and Settings\LocalService\Local Settings\Temp\_____6
Moves the following files:
- from %TEMP%\IXP000.TMP\AFSetup.exe to %ProgramFiles%\Microsoft Agent Framework\Agent Framework\AFSetup.exe
- from %ALLUSERSPROFILE%\Application Data\Microsoft\Application Compatibility Toolkit 5\DataCollector\Logging\AM-STATCOMP-{3BF5AAEF-847F-44b3-91DB-F8CC5E27D366}\STATUS-CRNJEUFU{D400FF9C-CB06-4CA2-8413... to %ALLUSERSPROFILE%\Application Data\Microsoft\Application Compatibility Toolkit 5\DataCollector\Failed\STATUS-CRNJEUFU{D400FF9C-CB06-4CA2-8413-DDED20AAD649}.xml.cab
Network activity:
Connects to:
- 'wp#d':80
- '20#.#6.232.182':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl via 20#.#6.232.182
UDP:
- DNS ASK wp#d
- DNS ASK crl.microsoft.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\IXP000.TMP\AFSetup.exe'
- '%ProgramFiles%\Microsoft Agent Framework\Agent Framework\actdcsvc.exe'
- '%ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\dep.exe' /install
- '%ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\uacce.exe' /install
- '%ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\dep.exe' /start
- '%ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\GSZ\ginasession0.exe' /start
- '%ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\uacce.exe' /start
- '%ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\envchange.exe'
- '%ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Collector\collect.exe' /o "%ALLUSERSPROFILE%\Application Data\Microsoft\Application Compatibility Toolkit 5\DataCollector\Logging\AM-COLLECT-{B5E60F57-258F-4a04-9641-31FC1D8139D8}" /s
- '%WINDIR%\AppPatch\gmeserv.exe'
- '%ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Compressor\compressor.exe' /c start /d "%ALLUSERSPROFILE%\Application Data\Microsoft\Application Compatibility Toolkit 5\DataCollector\Logging\AM-STATCOMP-{3BF5AAEF-847F-44b3-91DB-F8CC5E27D366}" /s "%ALLUSERSPROFILE%\App...
- '%ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\Uploader\uploader.exe' /c start /u "%ALLUSERSPROFILE%\Application Data\Microsoft\Application Compatibility Toolkit 5\DataCollector\Logging\AM-STATCOMP-{3BF5AAEF-847F-44b3-91DB-F8CC5E27D366}" /d "\\DEV106211\My Docume...
Executes the following:
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' /q /I "%TEMP%\IXP000.TMP\msxml6.msi" REBOOT=ReallySuppress APPGUID={DC93B45B-D4F5-4FFE-9B47-042BD6FA8CC5}
- '<SYSTEM32>\msiexec.exe' -Embedding 995CFC8C745EC9F1D085E93396F4D722
- '<SYSTEM32>\msiexec.exe' /q /I "%TEMP%\IXP000.TMP\AgentFramework.msi" REBOOT=ReallySuppress
- '<SYSTEM32>\cmd.exe' "%TEMP%\_remove.bat"
- '<SYSTEM32>\sdbinst.exe' -q "%ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\DEP\dep.sdb"
- '<SYSTEM32>\sdbinst.exe' -q "%ProgramFiles%\Microsoft Agent Framework\Agent Framework\Agents\UACCE\uacce.sdb"
