Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\OCS INVENTORY] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\OCS INVENTORY] 'ImagePath' = '"%ProgramFiles(x86)%\OCS Inventory Agent\ocsservice.exe"'
Modifies file system
Creates the following files
- <Current directory>\ocspackage.log
- %ProgramFiles(x86)%\ocs inventory agent\download.exe
- %ProgramFiles(x86)%\ocs inventory agent\inst32.exe
- %ProgramFiles(x86)%\ocs inventory agent\libeay32.dll
- %ProgramFiles(x86)%\ocs inventory agent\mfc42.dll
- %ProgramFiles(x86)%\ocs inventory agent\ocsinventory.exe
- %ProgramFiles(x86)%\ocs inventory agent\ocsservice.dll
- %ProgramFiles(x86)%\ocs inventory agent\ocsservice.exe
- %ProgramFiles(x86)%\ocs inventory agent\ocswmi.dll
- %ProgramFiles(x86)%\ocs inventory agent\ssleay32.dll
- %ProgramFiles(x86)%\ocs inventory agent\sysinfo.dll
- %ProgramFiles(x86)%\ocs inventory agent\psapi.dll
- %ProgramFiles(x86)%\ocs inventory agent\zlib.dll
- %ProgramFiles(x86)%\ocs inventory agent\service.ini
- %ProgramFiles(x86)%\ocs inventory agent\rand
- %ProgramFiles(x86)%\ocs inventory agent\ilfwbmbrljyr.log
- %ProgramFiles(x86)%\ocs inventory agent\admininfo.conf
- %ProgramFiles(x86)%\ocs inventory agent\ocsinventory.dat
- %ProgramFiles(x86)%\ocs inventory agent\biosinfo.exe
- %TEMP%\nscaf20.tmp\nsb798.tmp
- %ProgramFiles(x86)%\ocs inventory agent\ocs_contact.exe
- %TEMP%\nscaf20.tmp\userinfo.dll
- %TEMP%\nsua897.tmp\system.dll
- %TEMP%\nsua897.tmp\remcom.exe
- %TEMP%\nsua897.tmp\ocssetup.exe
- %TEMP%\nsua897.tmp\pack.ico
- %TEMP%\nsua897.tmp\instocs.exe
- %TEMP%\nsua897.tmp\cacert.pem
- %TEMP%\nsua897.tmp\ocsdat.ini
- %TEMP%\nsua897.tmp\userinfo.dll
- %TEMP%\nswad2b.tmp\system.dll
- %ProgramFiles(x86)%\ocs inventory agent\cacert.pem
- %TEMP%\nsmaf0f.tmp
- %TEMP%\nsua897.tmp\ocsagentsetup.log
- %TEMP%\nscaf20.tmp\system.dll
- %TEMP%\nscaf20.tmp\options.ini
- %TEMP%\nscaf20.tmp\splash.bmp
- %TEMP%\nscaf20.tmp\setacl.exe
- %TEMP%\nscaf20.tmp\advsplash.dll
- %TEMP%\nscaf20.tmp\killprocdll.dll
- %TEMP%\nscaf20.tmp\nsbf98.tmp
Deletes the following files
- %ProgramFiles(x86)%\ocs inventory agent\rand
- %TEMP%\nsua897.tmp\remcom.exe
- %TEMP%\nsua897.tmp\pack.ico
- %TEMP%\nsua897.tmp\ocssetup.exe
- %TEMP%\nsua897.tmp\ocsdat.ini
- %TEMP%\nsua897.tmp\ocsagentsetup.log
- %TEMP%\nsua897.tmp\instocs.exe
- %TEMP%\nsua897.tmp\cacert.pem
- %TEMP%\nswad2b.tmp\system.dll
- %TEMP%\nscaf20.tmp\userinfo.dll
- %TEMP%\nscaf20.tmp\system.dll
- %TEMP%\nscaf20.tmp\splash.bmp
- %TEMP%\nscaf20.tmp\setacl.exe
- %TEMP%\nscaf20.tmp\options.ini
- %TEMP%\nscaf20.tmp\killprocdll.dll
- %TEMP%\nscaf20.tmp\advsplash.dll
- %TEMP%\nscaf20.tmp\nsbf98.tmp
- %TEMP%\nscaf20.tmp\nsb798.tmp
- %TEMP%\nsua897.tmp\system.dll
- %TEMP%\nsua897.tmp\userinfo.dll
Network activity
Connects to
- '16#.#96.204.20':80
Miscellaneous
Creates and executes the following
- '%TEMP%\nsua897.tmp\instocs.exe'
- '%TEMP%\nsua897.tmp\ocssetup.exe' /S /SERVER:161.196.204.20 /PNUM:80 /DEBUG /tag:"PAT 2008" /now
- '%ProgramFiles(x86)%\ocs inventory agent\ocsservice.exe' -install
- '%ProgramFiles(x86)%\ocs inventory agent\ocsservice.exe' -start
- '%ProgramFiles(x86)%\ocs inventory agent\ocsservice.exe'
- '%ProgramFiles(x86)%\ocs inventory agent\ocsinventory.exe' /tag:"PAT 2008" /SERVER:161.196.204.20 /PNUM:80 /DEBUG
- '%ProgramFiles(x86)%\ocs inventory agent\download.exe' /tag:"PAT 2008" /SERVER:161.196.204.20 /PNUM:80 /DEBUG
- '%TEMP%\nscaf20.tmp\nsb798.tmp' setacl -on "OCS INVENTORY" -ot srv -actn ace -ace "n:S-1-5-32-545;p:start_stop;s:y" -ace "n:S-1-5-32-547;p:start_stop;s:y"
- '%TEMP%\nscaf20.tmp\setacl.exe' -on "OCS INVENTORY" -ot srv -actn ace -ace "n:S-1-5-32-545;p:start_stop;s:y" -ace "n:S-1-5-32-547;p:start_stop;s:y"
- '%TEMP%\nscaf20.tmp\nsbf98.tmp' setacl -on "%ProgramFiles(x86)%\OCS Inventory Agent\service.ini" -ot file -rec cont_obj -actn ace -ace "n:S-1-5-32-545;p:write;s:y" -ace "n:S-1-5-32-547;p:write;s:y"
- '%TEMP%\nscaf20.tmp\setacl.exe' -on "%ProgramFiles(x86)%\OCS Inventory Agent\service.ini" -ot file -rec cont_obj -actn ace -ace "n:S-1-5-32-545;p:write;s:y" -ace "n:S-1-5-32-547;p:write;s:y"
- '%TEMP%\nscaf20.tmp\nsb798.tmp' setacl -on "OCS INVENTORY" -ot srv -actn ace -ace "n:S-1-5-32-545;p:start_stop;s:y" -ace "n:S-1-5-32-547;p:start_stop;s:y"' (with hidden window)
- '%TEMP%\nscaf20.tmp\nsbf98.tmp' setacl -on "%ProgramFiles(x86)%\OCS Inventory Agent\service.ini" -ot file -rec cont_obj -actn ace -ace "n:S-1-5-32-545;p:write;s:y" -ace "n:S-1-5-32-547;p:write;s:y"' (with hidden window)
