Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM firefox.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM iexplore.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM chrome.exe
- '%WINDIR%\syswow64\net.exe' stop sacsrv
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM sacmonitor.exe
- '%WINDIR%\syswow64\net.exe' stop etoksrv
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM pkimonitor.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM etsrv.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
- iexplore.exe
Modifies file system
Creates the following files
- C:\sw_util_trt\log\<File name>.log
- C:\sw_util_trt\logcon\<File name>.log
Network activity
UDP
- DNS ASK it#####uca.trt15.jus.br
- DNS ASK ja#####ica.trt15.jus.br
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\setx.exe' ITAMAMBUCA_LOCAL itamambuca.trt15.jus.br' (with hidden window)
- '%WINDIR%\syswow64\net.exe' helpmsg 1' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM firefox.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM iexplore.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping jacarecica.trt15.jus.br -n 1 | find /i "TTL" > %TEMP%\logator_online.dat' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM chrome.exe' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop sacsrv' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM sacmonitor.exe' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop etoksrv' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM pkimonitor.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /T /IM etsrv.exe' (with hidden window)
- '%WINDIR%\syswow64\msiexec.exe' /x {4DFE8ACE-8652-4CCE-A2C1-DB23C7D4F4AA} /quiet /norestart' (with hidden window)
- '%WINDIR%\syswow64\msiexec.exe' /x {BC5C2BEB-87AF-4636-9184-CA10C3C740B8} /quiet /norestart' (with hidden window)
- '%WINDIR%\syswow64\msiexec.exe' /x {3B43CBCC-E353-4106-8409-937D9B728896} /quiet /norestart' (with hidden window)
- '%WINDIR%\syswow64\msiexec.exe' /x {77F14D68-4F8F-4D5B-90E1-29EDF00A0184} /quiet /norestart' (with hidden window)
- '%WINDIR%\syswow64\msiexec.exe' /i "<Current directory>\SafeNetAuthenticationClient-10.0-64bits.msi" /L*v c:\sw_util_trt\logsTRT\instalaSafenet.log ET_LANG_NAME=Portuguese PROP_CLEAR_REG=1 PROP_PROPAGATEUSERCER=1 /quiet /nor...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\setx.exe' ITAMAMBUCA_LOCAL itamambuca.trt15.jus.br
- '%WINDIR%\syswow64\net.exe' helpmsg 1
- '%WINDIR%\syswow64\net1.exe' helpmsg 1
- '%WINDIR%\syswow64\cmd.exe' /c ping jacarecica.trt15.jus.br -n 1 | find /i "TTL" > %TEMP%\logator_online.dat
- '%WINDIR%\syswow64\ping.exe' jacarecica.trt15.jus.br -n 1
- '%WINDIR%\syswow64\find.exe' /i "TTL"
- '%WINDIR%\syswow64\net1.exe' stop sacsrv
- '%WINDIR%\syswow64\net1.exe' stop etoksrv
- '%WINDIR%\syswow64\msiexec.exe' /x {4DFE8ACE-8652-4CCE-A2C1-DB23C7D4F4AA} /quiet /norestart
- '%WINDIR%\syswow64\msiexec.exe' /x {BC5C2BEB-87AF-4636-9184-CA10C3C740B8} /quiet /norestart
- '%WINDIR%\syswow64\msiexec.exe' /x {3B43CBCC-E353-4106-8409-937D9B728896} /quiet /norestart
- '%WINDIR%\syswow64\msiexec.exe' /x {77F14D68-4F8F-4D5B-90E1-29EDF00A0184} /quiet /norestart
- '%WINDIR%\syswow64\msiexec.exe' /i "<Current directory>\SafeNetAuthenticationClient-10.0-64bits.msi" /L*v c:\sw_util_trt\logsTRT\instalaSafenet.log ET_LANG_NAME=Portuguese PROP_CLEAR_REG=1 PROP_PROPAGATEUSERCER=1 /quiet /nor...
