Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name = "Interezen Process" dir=in action=allow program="%ProgramFiles(x86)%\IPinside_LWS\I3GProc.exe" enable=yes
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\ipinside_lws\interezen-rootca.crt
- %ProgramFiles(x86)%\ipinside_lws\vcredist_x86.exe
- %ProgramFiles(x86)%\ipinside_lws\interezen_sha1.crt
- %ProgramFiles(x86)%\ipinside_lws\interezen_sha1.opt
- %ProgramFiles(x86)%\ipinside_lws\interezenk_sha1.opt
- %ProgramFiles(x86)%\ipinside_lws\interezen-rootca_sha1.crt
- %ProgramFiles(x86)%\ipinside_lws\interezen.crt
- %ProgramFiles(x86)%\ipinside_lws\interezen.opt
- %ProgramFiles(x86)%\ipinside_lws\interezenk.opt
- %ProgramFiles(x86)%\ipinside_lws\i3gsvcmanager.exe
- D:\0da4ba30836acb15d7d59256dc57\vc_red.msi
- %WINDIR%\installer\$patchcache$\managed\2a868788ed6d5523aa29aab0a5958b47\9.0.30729\fl_msdia71_dll_2_60035_x86_ln.3643236f_fc70_11d3_a536_0090278a1bb8
- D:\0da4ba30836acb15d7d59256dc57\install.exe
- D:\0da4ba30836acb15d7d59256dc57\install.res.1042.dll
- D:\0da4ba30836acb15d7d59256dc57\eula.1042.txt
- D:\0da4ba30836acb15d7d59256dc57\globdata.ini
- D:\0da4ba30836acb15d7d59256dc57\install.ini
- D:\0da4ba30836acb15d7d59256dc57\vcredist.bmp
- D:\0da4ba30836acb15d7d59256dc57\$shtdwn$.req
- %TEMP%\dd_vcredistui1600.txt
- %TEMP%\dd_vcredistmsi1600.txt
- %ProgramFiles(x86)%\ipinside_lws\i3gmainsvc.exe
- D:\0da4ba30836acb15d7d59256dc57\vc_red.cab
- %ProgramFiles(x86)%\ipinside_lws\i3gmanager.dll
- %ProgramFiles(x86)%\ipinside_lws\certfr\libplc4.dll
- %ProgramFiles(x86)%\ipinside_lws\cosa.dll
- %ProgramFiles(x86)%\ipinside_lws\i3gescp.dll
- %ProgramFiles(x86)%\ipinside_lws\i3gex.exe
- %ProgramFiles(x86)%\ipinside_lws\ssleay32.dll
- %ProgramFiles(x86)%\ipinside_lws\libeay32.dll
- %ProgramFiles(x86)%\ipinside_lws\certmgr.exe
- %ProgramFiles(x86)%\ipinside_lws\certfr\certutil.exe
- %ProgramFiles(x86)%\ipinside_lws\certfr\freebl3.dll
- %ProgramFiles(x86)%\ipinside_lws\certfr\libnspr4.dll
- %ProgramFiles(x86)%\ipinside_lws\certfr\libplds4.dll
- %ProgramFiles(x86)%\ipinside_lws\i3gproc.exe
- %ProgramFiles(x86)%\ipinside_lws\certfr\nss3.dll
- %ProgramFiles(x86)%\ipinside_lws\certfr\nssckbi.dll
- %ProgramFiles(x86)%\ipinside_lws\certfr\nssdbm3.dll
- %ProgramFiles(x86)%\ipinside_lws\certfr\nssutil3.dll
- %ProgramFiles(x86)%\ipinside_lws\certfr\smime3.dll
- %ProgramFiles(x86)%\ipinside_lws\certfr\softokn3.dll
- %ProgramFiles(x86)%\ipinside_lws\certfr\sqlite3.dll
- %ProgramFiles(x86)%\ipinside_lws\certfr\ssl3.dll
- %WINDIR%\hipiw.dll
- %ProgramFiles(x86)%\ipinside_lws\i3ginit.exe
- %TEMP%\vwlacb2.tmp
Sets the 'hidden' attribute to the following files
- %WINDIR%\hipiw.dll
Deletes the following files
- %TEMP%\vwlacb2.tmp
- D:\0da4ba30836acb15d7d59256dc57\vcredist.bmp
- D:\0da4ba30836acb15d7d59256dc57\install.ini
- D:\0da4ba30836acb15d7d59256dc57\globdata.ini
- D:\0da4ba30836acb15d7d59256dc57\eula.1042.txt
- D:\0da4ba30836acb15d7d59256dc57\install.res.1042.dll
- D:\0da4ba30836acb15d7d59256dc57\install.exe
- D:\0da4ba30836acb15d7d59256dc57\vc_red.msi
- D:\0da4ba30836acb15d7d59256dc57\vc_red.cab
Network activity
Connects to
- 'localhost':21300
- 'oc##.#tartssl.com':80
UDP
- DNS ASK oc##.#tartssl.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\ipinside_lws\vcredist_x86.exe' /q:a /c:"msiexec /i vcredist.msi /qn /l*v %temp% credist_x86.log"
- 'D:\0da4ba30836acb15d7d59256dc57\install.exe' /q:a /c:"msiexec /i vcredist.msi /qn /l*v %temp% credist_x86.log"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name = "Interezen Process" dir=in action=allow program="%ProgramFiles(x86)%\IPinside_LWS\I3GProc.exe" enable=yes' (with hidden window)
- '%ProgramFiles(x86)%\ipinside_lws\vcredist_x86.exe' /q:a /c:"msiexec /i vcredist.msi /qn /l*v %temp% credist_x86.log"' (with hidden window)
