Trojan.Inject3.41258

Technical Information

Malicious functions

Injects code into

the following system processes:

%WINDIR%\syswow64\explorer.exe

Modifies file system

Creates the following files

%TEMP%\nsh8b8.tmp\system.dll
%TEMP%\service
%TEMP%\status
%TEMP%\event.log
%TEMP%\logparser.exe
%TEMP%\logparser.dll
%TEMP%\certkey
%TEMP%\nsh8b8.tmp\math.dll
%TEMP%\actualizaciones
%TEMP%\cert
%TEMP%\nsh8b8.tmp\nsexec.dll
%TEMP%\log.sql
%TEMP%\logparser.bat
%TEMP%\logparser.7z
%TEMP%\dump.bat
%TEMP%\serialnumber.bat
%TEMP%\cstoremini.vbs
%TEMP%\autoupdate.vbs
%TEMP%\ansitoutf8.vbs
%TEMP%\actualizaciones.vbs
%TEMP%\obtenerred.vbs
%TEMP%\getip.vbs
%TEMP%\blat.dll
%TEMP%\blat.exe
%TEMP%\7za.dll
%TEMP%\7za.exe
%TEMP%\cstore.vbs
%TEMP%\capicom.dll
%TEMP%\nsh8b8.tmp\nsprocess.dll
%TEMP%\nsh8b8.tmp\selfdel.dll

Deletes the following files

%TEMP%\nsh8b8.tmp\math.dll
%TEMP%\nsh8b8.tmp\nsexec.dll
%TEMP%\nsh8b8.tmp\nsprocess.dll
%TEMP%\nsh8b8.tmp\selfdel.dll
%TEMP%\nsh8b8.tmp\system.dll

Deletes itself.

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\wscript.exe' "%TEMP%\GetIP.vbs" "%TEMP%\IP"
'%WINDIR%\syswow64\wscript.exe' "%TEMP%\Actualizaciones.vbs" "%TEMP%\Actualizaciones"
'%TEMP%\logparser.exe' -i:evt file:"%TEMP%\Log.sql"
'%TEMP%\7za.exe' x -y LogParser.7z
'%WINDIR%\syswow64\cscript.exe'
'%WINDIR%\syswow64\wscript.exe' "%TEMP%\AutoUpdate.vbs"
'%TEMP%\logparser.exe' -i:evt file:"%TEMP%\Log.sql"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\LogParser.bat""' (with hidden window)
'%WINDIR%\syswow64\findstr.exe' /M /I "" %TEMP%\Certkey' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\SerialNumber.bat' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' OS get lastBootUpTime /Value' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' OS get version /value' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' OS get buildNumber /value' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' OS get installDate /value' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' OS get caption /value' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' OS get servicePackMajorVersion /value' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' OS get servicePackMinorVersion /value' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' OS get FreePhysicalMemory /Value' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' DISKDRIVE GET SerialNumber /value' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' OS get TotalVisibleMemorySize /value' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' cpu get Name /value' (with hidden window)
'%WINDIR%\syswow64\wscript.exe' "%TEMP%\Actualizaciones.vbs" "%TEMP%\Actualizaciones"' (with hidden window)
'%WINDIR%\syswow64\wscript.exe' "%TEMP%\GetIP.vbs" "%TEMP%\IP"' (with hidden window)
'%WINDIR%\syswow64\wbem\wmic.exe' OS get suiteMask /value' (with hidden window)
'%WINDIR%\syswow64\wscript.exe' "%TEMP%\AutoUpdate.vbs"' (with hidden window)