Technical Information
Modifies file system
Creates the following files
- %TEMP%\winsdksetup.exe
- %TEMP%\_mei23762\crypto.util.strxor.pyd
- %TEMP%\_mei23762\microsoft.vc90.crt.manifest
- %TEMP%\_mei23762\_ctypes.pyd
- %TEMP%\_mei23762\_hashlib.pyd
- %TEMP%\_mei23762\_multiprocessing.pyd
- %TEMP%\_mei23762\_socket.pyd
- %TEMP%\_mei23762\_ssl.pyd
- %TEMP%\_mei23762\crypto.random.osrng.winrandom.pyd
- %TEMP%\_mei23762\crypto.util._counter.pyd
- %TEMP%\_mei23762\bz2.pyd
- %TEMP%\_mei23762\msvcp90.dll
- %TEMP%\_mei23762\msvcr90.dll
- %TEMP%\_mei23762\pyexpat.pyd
- %TEMP%\_mei23762\python27.dll
- %TEMP%\_mei23762\select.pyd
- %TEMP%\_mei23762\unicodedata.pyd
- %TEMP%\hdd.exe
- %TEMP%\_mei23762\crypto.exe.manifest
- %TEMP%\_mei23762\msvcm90.dll
- %TEMP%\_mei23762\crypto.hash._sha256.pyd
- %TEMP%\_mei23762\crypto.cipher._des3.pyd
- %TEMP%\_mei23762\crypto.cipher._des.pyd
- %WINDIR%\temp\{41eb1ee9-c71d-4c38-9f0f-a0cb277fce6c}\.cr\winsdksetup.exe
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\mbahost.dll
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\license.rtf
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\mbapreq.png
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\mbapreq.thm
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\mbapreq.wxl
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\netfxlicense.rtf
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\bootstrappercore.config
- %HOMEPATH%\documents\crypto.exe
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\microsoft.bootstrapper.dll
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\bootstrappercore.dll
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\sqmapi.dll
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\microsoft.diagnostics.tracing.eventsource.dll
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\mbapreq.dll
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\userexperiencemanifest.xml
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\bootstrapperapplicationdata.xml
- %TEMP%\windowssdk\windows_software_development_kit___windows_10.0.18362.1_20191010174211.log
- %TEMP%\_mei23762\crypto.cipher._aes.pyd
- %WINDIR%\temp\{352bc79e-4dc1-46f2-95e9-d17c88e5a3ab}\.ba\microsoft.bootstrapper.presentation.dll
- \device\harddiskvolume3
- volume{600ba660-c712-11e6-a54f-080027cffa47}\system volume information\tracking.log.tmp
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\documents\crypto.exe
- %TEMP%\hdd.exe
Deletes the following files
- %TEMP%\hdd.exe
Moves the following files
- from volume{600ba660-c712-11e6-a54f-080027cffa47}\system volume information\tracking.log.tmp to volume{600ba660-c712-11e6-a54f-080027cffa47}\system volume information\tracking.log
Miscellaneous
Creates and executes the following
- '%TEMP%\winsdksetup.exe'
- '%HOMEPATH%\documents\crypto.exe'
- '%WINDIR%\temp\{41eb1ee9-c71d-4c38-9f0f-a0cb277fce6c}\.cr\winsdksetup.exe' -burn.clean.room="%TEMP%\winsdksetup.exe" -burn.filehandle.attached=192 -burn.filehandle.self=200
- '%TEMP%\hdd.exe'
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (with hidden window)
Executes the following
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
