Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\iconpack\setup files-ipack\header.png
- %ProgramFiles(x86)%\iconpack\resource files\patch\system32\imageres.dll
- %ProgramFiles(x86)%\iconpack\resource files\backup\system32\imageres.dll
- %ProgramFiles(x86)%\iconpack\resource files\acl\system32\imageres.dll.aclfile
- %ProgramFiles(x86)%\iconpack\patcher.exe
- %ProgramFiles(x86)%\iconpack\resource files\imagesp1.dll.res
- %ProgramFiles(x86)%\iconpack\resource files\imageres.dll.res
- %ProgramFiles(x86)%\iconpack\patcher.log
- %ProgramFiles(x86)%\iconpack\resource.7z
- %ProgramFiles(x86)%\iconpack\ipack_installer.exe
- %ProgramFiles(x86)%\iconpack\resource.ipack
- %ProgramFiles(x86)%\iconpack\ipack_installer.exe.config
- %ProgramFiles(x86)%\iconpack\setup files-ipack\configuration.config
- %ProgramFiles(x86)%\iconpack\setup files-ipack\license.txt
- %ProgramFiles(x86)%\iconpack\setup files-ipack\logo.png
- %ProgramFiles(x86)%\iconpack\7z.exe
- %ProgramFiles(x86)%\iconpack\patcher.ini
Sets the 'hidden' attribute to the following files
- %ProgramFiles(x86)%\iconpack\ipack_installer.exe.config
Deletes the following files
- %ProgramFiles(x86)%\iconpack\7z.exe
- %ProgramFiles(x86)%\iconpack\resource.7z
- %ProgramFiles(x86)%\iconpack\resource.ipack
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\iconpack\ipack_installer.exe'
- '%ProgramFiles(x86)%\iconpack\7z.exe' x -y -bd "%ProgramFiles(x86)%\iconpack\Resource.7z"
- '%ProgramFiles(x86)%\iconpack\patcher.exe' -addoverwrite "Resource Files\Patch\System32\imageres.dll", "Resource Files\Patch\System32\imageres.dll", "Resource Files\imageres.dll.res" ,,,
- '%ProgramFiles(x86)%\iconpack\7z.exe' x -y -bd "%ProgramFiles(x86)%\iconpack\Resource.7z"' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe' (with hidden window)
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\imageres.dll" /save "Resource Files\ACL\System32\imageres.dll.AclFile"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c takeown /a /F "<SYSTEM32>\imageres.dll" && icacls "<SYSTEM32>\imageres.dll" /grant:r "%username%":F && icacls "<SYSTEM32>\imageres.dll" /grant:r "administrators":F && exit' (with hidden window)
Executes the following
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\imageres.dll" /save "Resource Files\ACL\System32\imageres.dll.AclFile"
- '<SYSTEM32>\cmd.exe' /c takeown /a /F "<SYSTEM32>\imageres.dll" && icacls "<SYSTEM32>\imageres.dll" /grant:r "%username%":F && icacls "<SYSTEM32>\imageres.dll" /grant:r "administrators":F && exit
- '<SYSTEM32>\takeown.exe' /a /F "<SYSTEM32>\imageres.dll"
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\imageres.dll" /grant:r "user":F
- '<SYSTEM32>\icacls.exe' "<SYSTEM32>\imageres.dll" /grant:r "administrators":F
