Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %TEMP%\aut221a.tmp
- C:\quickdiag\mbr\winlogon.exe
- %TEMP%\aut21bb.tmp
- C:\quickdiag\g3n.ico
- %TEMP%\aut218b.tmp
- C:\quickdiag\pre_scan.ico
- %TEMP%\aut216b.tmp
- C:\quickdiag\pidtemp\pidmodule64.exe
- %TEMP%\aut20de.tmp
- C:\quickdiag\pidtemp\pidmodule32.exe
- %TEMP%\aut206f.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\d6lnvv34\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\59exydw0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\sdsq0s25\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7tzixxgg\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- C:\quickdiag\mbr\mbrwiz
- C:\quickdiag\mbr.bin
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7tzixxgg\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\sdsq0s25\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\59exydw0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\d6lnvv34\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- %TEMP%\aut206f.tmp
- %TEMP%\aut20de.tmp
- %TEMP%\aut216b.tmp
- %TEMP%\aut218b.tmp
- %TEMP%\aut21bb.tmp
- %TEMP%\aut221a.tmp
- C:\quickdiag\mbr\mbrwiz
- C:\quickdiag\mbr\winlogon.exe
Network activity
TCP
- 'ge###ackman.com':443
UDP
- DNS ASK ge###ackman.com
Miscellaneous
Creates and executes the following
- 'C:\quickdiag\mbr\winlogon.exe' /Save=C:\QuickDiag\MBR.bin
- '%WINDIR%\syswow64\cmd.exe' /c dir /b /s /a "%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\CONTENT.IE5\QuickD*.ht*" > "%LOCALAPPDATA%\Temprad574BC.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c dir /b /s /a "%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\CONTENT.IE5\QuickD*.ht*" > "%LOCALAPPDATA%\Temprad574BC.tmp"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /c%HomeDrive%\QuickDiag\MBR\Winlogon.exe /Save=%HomeDrive%\QuickDiag\MBR.bin
