Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\centurylinkinstallersetup.exe
- %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is8993.tmp
- %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def8992.tmp
- %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr8982.tmp
- %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str8971.tmp
- %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isb8960.tmp
- %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\dot895f.tmp
- %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\cor894f.tmp
- %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif894e.tmp
- %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon893d.tmp
- %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set892d.tmp
- %TEMP%\88ed.tmp
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\0x0409.ini
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\setup.ini
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\setup.iss
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\setup.inx
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\setup.ini
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\setup.exe
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\md5sum.exe
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\license.rtf
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\layout.bin
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\issetup.dll
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\data1.hdr
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\data1.cab
- %TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\0x0409.ini
- %TEMP%\rarsfx0\config.ini
- %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is8994.tmp
- %WINDIR%\centurylinkinstallersetup.log
Moves the following files
- from %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set892d.tmp to %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\setup.inx
- from %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon893d.tmp to %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fontdata.ini
- from %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif894e.tmp to %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\difxdata.ini
- from %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\cor894f.tmp to %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\corecomp.ini
- from %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\dot895f.tmp to %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\dotnetinstaller.exe
- from %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isb8960.tmp to %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe
- from %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str8971.tmp to %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\stringtable_0x0409.ips
- from %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr8982.tmp to %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isrt.dll
- from %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def8992.tmp to %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\default.pal
- from %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is8993.tmp to %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isuser_0x0409.dll
- from %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is8994.tmp to %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isres_0x0409.dll
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\centurylinkinstallersetup.exe'
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1F80BFE5-A1B5-4406-944B-E01655EBD246}
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A8A05E79-32FF-4C82-8C75-20E2D4E9F1B9}
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CE28CD7E-CE4D-4839-8427-93123C2DC264}
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9F2102FD-1BEC-4561-93D9-225A395CC3F8}
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DC777599-D307-423D-A4D5-D47E3677925B}
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1CD10AF7-FDEF-4A82-AC95-9BE653F13AAF}
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{45F59291-12C5-4F15-AD73-701EAAFA325E}
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4472B7FF-7313-4583-B537-B443494A95FA}
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2135684B-C967-4AA8-A56B-2B4384760EC9}
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{104A0CA3-6637-4FFB-B1A3-A4669C724A5E}
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{82EFC087-8F42-485C-A880-255020C239B4}
- '%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2A352B30-450E-4E1E-B6BF-C8FD5179645C}
- '%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe' (with hidden window)
