Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TickTick.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\32.exe
- %TEMP%\rarsfx0\crack.7z
- %TEMP%\rarsfx0\cybermania.url
- %TEMP%\rarsfx0\tick_win_setup_release_x86.exe
- %TEMP%\is-n1tdm.tmp\tick_win_setup_release_x86.tmp
- %TEMP%\is-dv7ei.tmp\_isetup\_setup64.tmp
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\tick_win_setup_release_x86.exe' /silent
- '%TEMP%\is-n1tdm.tmp\tick_win_setup_release_x86.tmp' /SL5="$1025A,15265663,1145856,%TEMP%\RarSFX0\tick_win_setup_release_x86.exe" /silent
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im TickTick.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im TickTick.exe' (with hidden window)
