Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\PROTOCOLS\Handler\http] 'CLSID' = '{79eac9e2-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\Software\Classes\PROTOCOLS\Handler\ftp] 'CLSID' = '{79eac9e3-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\Software\Classes\PROTOCOLS\Handler\gopher] 'CLSID' = '{79eac9e4-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\Software\Classes\PROTOCOLS\Handler\https] 'CLSID' = '{79eac9e5-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\Software\Classes\PROTOCOLS\Handler\mk] 'CLSID' = '{79eac9e6-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\Software\Classes\PROTOCOLS\Handler\file] 'CLSID' = '{79eac9e7-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\Software\Classes\PROTOCOLS\Handler\local] 'CLSID' = '{79eac9e7-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\Software\Classes\PROTOCOLS\Filter\deflate] 'CLSID' = '{8f6b0360-b80d-11d0-a9b3-006097942311}'
- [<HKLM>\Software\Classes\PROTOCOLS\Filter\gzip] 'CLSID' = '{8f6b0360-b80d-11d0-a9b3-006097942311}'
- [<HKLM>\Software\Classes\PROTOCOLS\Handler\cdl] 'CLSID' = '{3dd53d40-7b8b-11D0-b013-00aa0059ce02}'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ssrang_supportdotcom] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ssrang_supportdotcom] 'ImagePath' = '"%ProgramFiles(x86)%\supportdotcom\rang\ssrangsv.exe" -service "-provider" "supportdotcom"'
- [<HKLM>\System\CurrentControlSet\Services\ssmirrdr] 'ImagePath' = 'system32\DRIVERS\ssmirrdr.sys'
Creates the following services
- 'ssrang_supportdotcom' "%ProgramFiles(x86)%\supportdotcom\rang\ssrangsv.exe" -service "-provider" "supportdotcom"
- 'ssmirrdr' system32\DRIVERS\ssmirrdr.sys
Modifies file system
Creates the following files
- %TEMP%\nscb3.tmp\system.dll
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@bing[2].txt
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@bing[1].txt
- %WINDIR%\temp\uddfe9b.tmp
- %APPDATA%\supportdotcom\logs\consumer_ui_3048_.log
- %ProgramFiles(x86)%\supportdotcom\rang\logs\ssrangsv_[7-1-2020 - 20.59.55].log
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %ProgramFiles(x86)%\supportdotcom\rang\logs\ssrangsv_[7-1-2020 - 20.59.43].log
- %ProgramFiles(x86)%\supportdotcom\rang\logs\ssrangsv_[7-1-2020 - 20.59.26].log
- %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\set21e9.tmp
- %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\set20cf.tmp
- %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\nt_amd64\set1eca.tmp
- %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\nt_amd64\set1db0.tmp
- %ProgramFiles(x86)%\supportdotcom\rang\uninst.exe
- %ProgramFiles(x86)%\supportdotcom\rang\desktop_dupl.dll
- %ProgramFiles(x86)%\supportdotcom\rang\ca-bundle.crt
- %ProgramFiles(x86)%\supportdotcom\rang\support.ico
- %ProgramFiles(x86)%\supportdotcom\rang\ssranghk.dll
- %ProgramFiles(x86)%\supportdotcom\rang\nsd28b.tmp
- %ProgramFiles(x86)%\supportdotcom\rang\nss113.tmp
- %ProgramFiles(x86)%\supportdotcom\rang\nsc102.tmp
- %CommonProgramFiles(x86)%\supportdotcom\rang\nt_x86\ssmirrdr.sys
- %CommonProgramFiles(x86)%\supportdotcom\rang\nt_x86\ssmirrdr.dll
- %CommonProgramFiles(x86)%\supportdotcom\rang\nt_amd64\ssmirrdr.sys
- %CommonProgramFiles(x86)%\supportdotcom\rang\nt_amd64\ssmirrdr.dll
- %CommonProgramFiles(x86)%\supportdotcom\rang\ssmirrdr.inf
- %CommonProgramFiles(x86)%\supportdotcom\rang\ssmirrdr-nt_x86.cat
- %CommonProgramFiles(x86)%\supportdotcom\rang\ssmirrdr-nt_amd64.cat
- %CommonProgramFiles(x86)%\supportdotcom\rang\driverinst64.exe
- %CommonProgramFiles(x86)%\supportdotcom\rang\driverinst.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@www.bing[1].txt
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\62axopq5\bing_com[1].txt
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Deletes the following files
- %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\nt_amd64\ssmirrdr.dll
- %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\nt_amd64\ssmirrdr.sys
- %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\ssmirrdr-nt_amd64.cat
- %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\ssmirrdr.inf
- %TEMP%\nscb3.tmp\system.dll
- %WINDIR%\temp\uddfe9b.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@bing[1].txt
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@bing[2].txt
Moves the following files
- from %ProgramFiles(x86)%\supportdotcom\rang\nsc102.tmp to %ProgramFiles(x86)%\supportdotcom\rang\saslib.dll
- from %ProgramFiles(x86)%\supportdotcom\rang\nss113.tmp to %ProgramFiles(x86)%\supportdotcom\rang\ssrangsv.exe
- from %ProgramFiles(x86)%\supportdotcom\rang\nsd28b.tmp to %ProgramFiles(x86)%\supportdotcom\rang\ssrangui.exe
- from %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\nt_amd64\set1db0.tmp to %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\nt_amd64\ssmirrdr.dll
- from %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\nt_amd64\set1eca.tmp to %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\nt_amd64\ssmirrdr.sys
- from %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\set20cf.tmp to %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\ssmirrdr.inf
- from %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\set21e9.tmp to %TEMP%\{44867540-460e-5126-6162-733fbd4c5e6b}\ssmirrdr-nt_amd64.cat
Substitutes the following files
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@bing[1].txt
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@bing[2].txt
Network activity
TCP
HTTP GET requests
- http://www.wo####imeserver.com/current_time_in_US-CA.aspx
HTTP POST requests
- http://ct######er-rang.support.com/rpc/rang
UDP
- DNS ASK ct######er-rang.support.com
- DNS ASK google.com
- DNS ASK bing.com
- DNS ASK wo####imeserver.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%CommonProgramFiles(x86)%\supportdotcom\rang\driverinst64.exe' /Install
- '%ProgramFiles(x86)%\supportdotcom\rang\ssrangsv.exe' /provider supportdotcom /setup
- '%ProgramFiles(x86)%\supportdotcom\rang\ssrangsv.exe' /provider supportdotcom /regserver /start
- '%ProgramFiles(x86)%\supportdotcom\rang\ssrangsv.exe' -service "-provider" "supportdotcom"
- '%ProgramFiles(x86)%\supportdotcom\rang\ssrangui.exe' -start -ec 0 475140394 -agentFriendlyName 'Solutions Engineer'
