Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{f1ba6611-16fa-402f-b96c-659c8cf67e1a}' = '"<LS_APPDATA>\Package Cache\{f1ba6611-16fa-402f-b96c-659c8cf67e1a}\SelfExtract.exe" /burn.runo...
Modifies file system:
Creates the following files:
- %APPDATA%\upp.exe
- %WINDIR%\Installer\4f597.msi
- %TEMP%\Weather_Buddy_20180528163220_000_WeatherBuddy.log
- %TEMP%\{FADE9CFC-AAED-4CC2-9C88-689A4BAC86EE}\WeatherBuddy
- <LS_APPDATA>\Package Cache\{f1ba6611-16fa-402f-b96c-659c8cf67e1a}\state.rsm
- <LS_APPDATA>\Package Cache\{f1ba6611-16fa-402f-b96c-659c8cf67e1a}\SelfExtract.exe
- %TEMP%\{FADE9CFC-AAED-4CC2-9C88-689A4BAC86EE}\.be\SelfExtract.exe
- %TEMP%\Weather_Buddy_20180528163220.log
- %TEMP%\{FADE9CFC-AAED-4CC2-9C88-689A4BAC86EE}\.ba\BootstrapperApplicationData.xml
- %TEMP%\{FADE9CFC-AAED-4CC2-9C88-689A4BAC86EE}\.ba\license.rtf
- %WINDIR%\Installer\MSI1.tmp
- %TEMP%\{FADE9CFC-AAED-4CC2-9C88-689A4BAC86EE}\.ba\logo.png
- %TEMP%\{FADE9CFC-AAED-4CC2-9C88-689A4BAC86EE}\.ba\thm.xml
- %TEMP%\{FADE9CFC-AAED-4CC2-9C88-689A4BAC86EE}\.ba\wixstdba.dll
- %TEMP%\{1BF9FDEC-CC4C-4660-97E6-2C7A22AF7DE7}\.cr\converter_ni_139_23T_b_.exe
- %APPDATA%\converter_ni_139_23T_b_.exe
- %APPDATA%\svr.crt
- %TEMP%\IXP000.TMP\install.exe
- %TEMP%\IXP000.TMP\setup.bat
- %TEMP%\IXP000.TMP\SqadU9FBEV.bat
- %TEMP%\IXP000.TMP\NYkjVVXepl.vbe
- %TEMP%\{FADE9CFC-AAED-4CC2-9C88-689A4BAC86EE}\.ba\thm.wxl
- %WINDIR%\Installer\MSI2.tmp
Deletes the following files:
- %WINDIR%\Installer\MSI1.tmp
Moves the following files:
- from %TEMP%\{FADE9CFC-AAED-4CC2-9C88-689A4BAC86EE}\WeatherBuddy to <LS_APPDATA>\Package Cache\.unverified\WeatherBuddy
- from <LS_APPDATA>\Package Cache\.unverified\WeatherBuddy to <LS_APPDATA>\Package Cache\{E0393537-5CD1-459A-9D23-8EF06235636B}v1.0.23\WeatherBuddy_ni_v23.msi
Network activity:
Connects to:
- 'localhost':1038
- 'ev##tz.win':13463
UDP:
- DNS ASK ev##tz.win
- DNS ASK _l###.####.dc._msdcs.kuikdelivery.com
Miscellaneous:
Creates and executes the following:
- '%APPDATA%\upp.exe'
- '%TEMP%\IXP000.TMP\install.exe' setup.bat
- '%APPDATA%\converter_ni_139_23T_b_.exe' -norestart -repair -s
- '%TEMP%\{1BF9FDEC-CC4C-4660-97E6-2C7A22AF7DE7}\.cr\converter_ni_139_23T_b_.exe' -burn.clean.room="%APPDATA%\converter_ni_139_23T_b_.exe" -burn.filehandle.attached=348 -burn.filehandle.self=344 -norestart -repair -s
Executes the following:
- '<SYSTEM32>\cmd.exe' /c netsh interface ipv4 show interfaces
- '<SYSTEM32>\netsh.exe' interface ipv4 show interfaces
- '<SYSTEM32>\cmd.exe' /c setup.bat
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\cscript.exe' NYkjVVXepl.vbe qavriknzkk nil
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 318688D9C920290E17BA5385A7C452F9
- '<SYSTEM32>\ping.exe' -n 11 127.0.0.1
