Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\795870] 'ImagePath' = 'cmd /c start "" cmd /c start "" "%APPDATA%\AD2227FEAA\ebaf2690\7sag3323\svtkribss.exe" "208dc741" 1048 "%APPDATA%\AD2227FEAA\ebaf2...
Creates the following services
- '795870' cmd /c start "" cmd /c start "" "%APPDATA%\AD2227FEAA\ebaf2690\7sag3323\svtkribss.exe" "208dc741" 1048 "%APPDATA%\AD2227FEAA\ebaf2690\7sag3323\"
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\is-l4bto.tmp\<File name>.tmp
- %TEMP%\is-t2qen.tmp\_isetup\_setup64.tmp
- %APPDATA%\ad2227feaa\asgawaw2\asgsagw2\is-qljmn.tmp
- %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-56rs3.tmp
- %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-62u93.tmp
- %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-n6i5e.tmp
- %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-3g4rd.tmp
- %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-e5mig.tmp
- %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-musk8.tmp
- %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-3m648.tmp
- %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-dolog.tmp
- %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-sncit.tmp
- %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-89i16.tmp
- %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-7hlrt.tmp
- %HOMEPATH%\desktop\goog le.lnk
Deletes the following files
- %TEMP%\is-t2qen.tmp\_isetup\_setup64.tmp
- %TEMP%\is-l4bto.tmp\<File name>.tmp
Moves the following files
- from %APPDATA%\ad2227feaa\asgawaw2\asgsagw2\is-qljmn.tmp to %APPDATA%\ad2227feaa\asgawaw2\asgsagw2\3wgaw.exe
- from %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-56rs3.tmp to %APPDATA%\ad2227feaa\ebaf2690\7sag3323\dfab9ef57ad7cd4b566b.42ee561
- from %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-62u93.tmp to %APPDATA%\ad2227feaa\ebaf2690\7sag3323\glib-2.0-0.dll
- from %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-n6i5e.tmp to %APPDATA%\ad2227feaa\ebaf2690\7sag3323\gmodule-2.0-0.dll
- from %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-3g4rd.tmp to %APPDATA%\ad2227feaa\ebaf2690\7sag3323\gobject-2.0-0.dll
- from %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-e5mig.tmp to %APPDATA%\ad2227feaa\ebaf2690\7sag3323\gwakghje.exe
- from %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-musk8.tmp to %APPDATA%\ad2227feaa\ebaf2690\7sag3323\intl.dll
- from %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-3m648.tmp to %APPDATA%\ad2227feaa\ebaf2690\7sag3323\pcre2-8.dll
- from %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-dolog.tmp to %APPDATA%\ad2227feaa\ebaf2690\7sag3323\svtkribss.exe
- from %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-sncit.tmp to %APPDATA%\ad2227feaa\ebaf2690\7sag3323\vcruntime140.dll
- from %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-89i16.tmp to %APPDATA%\ad2227feaa\ebaf2690\7sag3323\vcruntime140_1.dll
- from %APPDATA%\ad2227feaa\ebaf2690\7sag3323\is-7hlrt.tmp to %APPDATA%\ad2227feaa\ebaf2690\7sag3323\vmtools.dll
Network activity
TCP
Other
- '34.##9.100.209':443
Miscellaneous
Creates and executes the following
- '%TEMP%\is-l4bto.tmp\<File name>.tmp' /SL5="$80170,23382356,827392,<Full path to file>"
- '%APPDATA%\ad2227feaa\ebaf2690\7sag3323\gwakghje.exe'
- '%APPDATA%\ad2227feaa\ebaf2690\7sag3323\svtkribss.exe' 4ecbd3142f9b075b 2040 "%APPDATA%\AD2227FEAA\ebaf2690\7sag3323\"
- '%APPDATA%\ad2227feaa\ebaf2690\7sag3323\svtkribss.exe' "208dc741" 1048 "%APPDATA%\AD2227FEAA\ebaf2690\7sag3323\"
Executes the following
- '<SYSTEM32>\cmd.exe' /c start "" cmd /c start "" "%APPDATA%\AD2227FEAA\ebaf2690\7sag3323\svtkribss.exe" "208dc741" 1048 "%APPDATA%\AD2227FEAA\ebaf2690\7sag3323\"
- '<SYSTEM32>\cmd.exe' /c start "" "%APPDATA%\AD2227FEAA\ebaf2690\7sag3323\svtkribss.exe" "208dc741" 1048 "%APPDATA%\AD2227FEAA\ebaf2690\7sag3323\"
- '%APPDATA%\ad2227feaa\ebaf2690\7sag3323\gwakghje.exe' ' (with hidden window)
- '%WINDIR%\cyjfcqlau9rg\app-0.82.1\svtkribss.exe' ' (with hidden window)
