Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'aisinocertreg' = '%ProgramFiles(x86)%\twus\twustwus.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'aisinocertreg1' = '<SYSTEM32>\Mornitor32\jsjkjsjk.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im "twustwus.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /im "jsjkjsjk.exe"
Modifies file system
Creates the following files
- %TEMP%\is-v45nm.tmp\<File name>.tmp
- %ProgramFiles(x86)%\twus\is-401e3.tmp
- %ProgramFiles(x86)%\twus\is-786vs.tmp
- %ProgramFiles(x86)%\twus\is-pg8lg.tmp
- %ProgramFiles(x86)%\twus\is-n8ckf.tmp
- %ProgramFiles(x86)%\twus\is-9a653.tmp
- %ProgramFiles(x86)%\twus\is-jb86m.tmp
- %ProgramFiles(x86)%\twus\is-52cpr.tmp
- %ProgramFiles(x86)%\twus\is-thusb.tmp
- %ProgramFiles(x86)%\twus\is-97sks.tmp
- %ProgramFiles(x86)%\twus\is-a6a2e.tmp
- %ProgramFiles(x86)%\twus\is-ujo5j.tmp
- %ProgramFiles(x86)%\twus\is-sa8f9.tmp
- %ProgramFiles(x86)%\twus\is-ide3l.tmp
- %ProgramFiles(x86)%\twus\is-1epkd.tmp
- %ProgramFiles(x86)%\twus\is-9dbp0.tmp
- %ProgramFiles(x86)%\twus\is-6780i.tmp
- %WINDIR%\syswow64\mornitor32\is-28brn.tmp
- %ProgramFiles(x86)%\twus\is-jr5hq.tmp
- %ProgramFiles(x86)%\twus\is-cnlo9.tmp
- %TEMP%\is-tdund.tmp\_isetup\_setup64.tmp
- %TEMP%\setup log 2021-03-05 #001.txt
- %ProgramFiles(x86)%\twus\unins000.dat
- C:\debugcheck.ini
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\mornitor32\jsjkjsjk.exe
Deletes the following files
- %TEMP%\is-tdund.tmp\_isetup\_setup64.tmp
- %TEMP%\is-v45nm.tmp\<File name>.tmp
Moves the following files
- from %ProgramFiles(x86)%\twus\is-cnlo9.tmp to %ProgramFiles(x86)%\twus\unins000.exe
- from %ProgramFiles(x86)%\twus\is-pg8lg.tmp to %ProgramFiles(x86)%\twus\areaconfig.json
- from %ProgramFiles(x86)%\twus\is-n8ckf.tmp to %ProgramFiles(x86)%\twus\wthw.dll
- from %ProgramFiles(x86)%\twus\is-9a653.tmp to %ProgramFiles(x86)%\twus\usbkhelp.dll
- from %ProgramFiles(x86)%\twus\is-jb86m.tmp to %ProgramFiles(x86)%\twus\usbkey_detection.dll
- from %ProgramFiles(x86)%\twus\is-52cpr.tmp to %ProgramFiles(x86)%\twus\swukey_skf.dll
- from %ProgramFiles(x86)%\twus\is-thusb.tmp to %ProgramFiles(x86)%\twus\twustwus.dll
- from %ProgramFiles(x86)%\twus\is-97sks.tmp to %ProgramFiles(x86)%\twus\smdll.dll
- from %ProgramFiles(x86)%\twus\is-786vs.tmp to %ProgramFiles(x86)%\twus\cacert.h
- from %ProgramFiles(x86)%\twus\is-a6a2e.tmp to %ProgramFiles(x86)%\twus\nisec_pkcsshell.dll
- from %ProgramFiles(x86)%\twus\is-sa8f9.tmp to %ProgramFiles(x86)%\twus\libeay32.dll
- from %ProgramFiles(x86)%\twus\is-ide3l.tmp to %ProgramFiles(x86)%\twus\getdevinfo.dll
- from %ProgramFiles(x86)%\twus\is-1epkd.tmp to %ProgramFiles(x86)%\twus\escommon.dll
- from %ProgramFiles(x86)%\twus\is-9dbp0.tmp to %ProgramFiles(x86)%\twus\ctptkcs.dll
- from %ProgramFiles(x86)%\twus\is-6780i.tmp to %ProgramFiles(x86)%\twus\cryp_api.dll
- from %WINDIR%\syswow64\mornitor32\is-28brn.tmp to %WINDIR%\syswow64\mornitor32\jsjkjsjk.exe
- from %ProgramFiles(x86)%\twus\is-jr5hq.tmp to %ProgramFiles(x86)%\twus\twustwus.exe
- from %ProgramFiles(x86)%\twus\is-ujo5j.tmp to %ProgramFiles(x86)%\twus\mtoken_gm.dll
- from %ProgramFiles(x86)%\twus\is-401e3.tmp to %ProgramFiles(x86)%\twus\crypt_api.ini
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-v45nm.tmp\<File name>.tmp' /SL5="$A0226,2920145,58368,<Full path to file>"
- '%ProgramFiles(x86)%\twus\twustwus.exe'
- '%WINDIR%\syswow64\mornitor32\jsjkjsjk.exe'
- '%WINDIR%\syswow64\taskkill.exe' /f /im "twustwus.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im "jsjkjsjk.exe"' (with hidden window)
