Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\setup.js
- <SYSTEM32>\tasks\anydesk
Modifies file system
Creates the following files
- %TEMP%\setup.exe
- %TEMP%\ai_extui_bin_2744\folderlogoicon
- %TEMP%\ai_extui_bin_2744\sys_close_hot.bmp
- %TEMP%\ai_extui_bin_2744\sys_close_normal.bmp
- %TEMP%\ai_extui_bin_2744\sys_close_inactive.bmp
- %TEMP%\ai_extui_bin_2744\frame_bottom_right_inactive.bmp
- %TEMP%\ai_extui_bin_2744\sys_min_down.bmp
- %TEMP%\ai_extui_bin_2744\sys_min_hot.bmp
- %TEMP%\ai_extui_bin_2744\sys_min_normal.bmp
- %TEMP%\ai_extui_bin_2744\sys_min_inactive.bmp
- %TEMP%\ai_extui_bin_2744\frame_top_left.bmp
- %TEMP%\ai_extui_bin_2744\frame_caption.bmp
- %TEMP%\ai_extui_bin_2744\frame_caption_inactive.bmp
- %TEMP%\ai_extui_bin_2744\frame_top_right.bmp
- %TEMP%\ai_extui_bin_2744\frame_top_right_inactive.bmp
- %TEMP%\ai_extui_bin_2744\frame_right_inactive.bmp
- %TEMP%\ai_extui_bin_2744\frame_left.bmp
- %TEMP%\ai_extui_bin_2744\frame_left_inactive.bmp
- %TEMP%\ai_extui_bin_2744\frame_right.bmp
- %TEMP%\ai_extui_bin_2744\frame_bottom_left_inactive.bmp
- %TEMP%\ai_extui_bin_2744\frame_bottom_mid.bmp
- %TEMP%\ai_extui_bin_2744\frame_bottom_mid_inactive.bmp
- %TEMP%\ai_extui_bin_2744\aicustact.dll
- %TEMP%\ai_extui_bin_2744\cmdlinkarrow
- %TEMP%\ai_extui_bin_2744\lzmaextractor.dll
- %TEMP%\ai_extui_bin_2744\prereq.dll
- %TEMP%\ai_extui_bin_2744\minbackground
- %TEMP%\ai_extui_bin_2744\applogoicon
- %TEMP%\ai_extui_bin_2744\insticon
- %TEMP%\ai_extui_bin_2744\ico
- %TEMP%\setup.js
- %APPDATA%\sourcetec software\sothink logo maker professional 4.4.4625\install\sothink logo maker professional.msi
- %TEMP%\msi2fdc.tmp
- %TEMP%\msi3461.tmp
- %TEMP%\ai_extui_bin_2744\installlogoicon
- %TEMP%\ai_extui_bin_2744\frame_top_mid_inactive.bmp
- %TEMP%\ai_extui_bin_2744\background
- %TEMP%\ai_extui_bin_2744\frame_top_left_inactive.bmp
- %TEMP%\ai_extui_bin_2744\printico
- %TEMP%\ai_extui_bin_2744\frame_top_mid.bmp
- %TEMP%\ai_extui_bin_2744\repairic
- %TEMP%\ai_extui_bin_2744\exitbackground
- %TEMP%\ai_extui_bin_2744\whitebackground
- %TEMP%\ai_extui_bin_2744\frame_bottom_left.bmp
- %TEMP%\ai_extui_bin_2744\frame_bottom_right.bmp
- %TEMP%\ai_extui_bin_2744\sys_close_down.bmp
- %TEMP%\ai_extui_bin_2744\exclamic
- %TEMP%\ai_extui_bin_2744\info
- %TEMP%\ai_extui_bin_2744\tabback
- %TEMP%\ai_extui_bin_2744\removico
- %TEMP%\ai_extui_bin_2744\up
- %TEMP%\ai_extui_bin_2744\new
- %TEMP%\ai_extui_bin_2744\waitlogoicon
- %TEMP%\ai_extui_bin_2744\completi
- %TEMP%\ai_extui_bin_2744\optionslogoicon
- %TEMP%\ai_extui_bin_2744\custicon
- %TEMP%\msi3992.tmp
Deletes the following files
- %TEMP%\msi2fdc.tmp
- %TEMP%\msi3461.tmp
- %TEMP%\msi3992.tmp
Network activity
UDP
- DNS ASK ls###.publicvm.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\setup.js"
- '%TEMP%\setup.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 30 /tn anydesk /tr "%TEMP%\setup.js' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 30 /tn anydesk /tr "%TEMP%\setup.js
