Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\microsoft.86.36.vbs
Modifies file system
Creates the following files
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\4.tmp
- %TEMP%\$inst\5.tmp
- %TEMP%\$inst\temp_0.tmp
- %HOMEPATH%\documents\set.exe
- %HOMEPATH%\documents\microsoft.86.36.vbs
- %ProgramFiles(x86)%\microsoft\microsoft\uninstall.exe
- %ProgramFiles(x86)%\microsoft\microsoft\uninstall.ini
- C:\users\public\upload.ps1
- C:\users\public\new.vbs
- C:\users\public\pp.ps1
- C:\users\public\run.vbs
- %TEMP%\is-c0v2h.tmp\set.tmp
- %TEMP%\is-53c1u.tmp\_isetup\_setup64.tmp
- C:\users\public\update.ps1
Deletes the following files
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\4.tmp
- %TEMP%\$inst\5.tmp
Network activity
TCP
HTTP GET requests
- http://on####ve.linkpc.net/Ahmad/255Ah.jpg
UDP
- DNS ASK on####ve.linkpc.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%HOMEPATH%\Documents\Microsoft.86.36.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\Users\Public\run.vbs"
- '%HOMEPATH%\documents\set.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\pp.ps1
- '%TEMP%\is-c0v2h.tmp\set.tmp' /SL5="$3026A,147042,141824,%HOMEPATH%\Documents\Set.exe"
- '%WINDIR%\syswow64\wscript.exe' "C:\Users\Public\new.vbs"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\upload.ps1
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\update.ps1
- '%WINDIR%\syswow64\cmd.exe' /c copy "%HOMEPATH%/Documents\Microsoft.86.36.vbs" "%HOMEPATH%/AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.86.36.vbs" /Y' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\pp.ps1' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\upload.ps1' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\update.ps1' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy "%HOMEPATH%/Documents\Microsoft.86.36.vbs" "%HOMEPATH%/AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.86.36.vbs" /Y
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\update.ps1
