Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{817e21c1-6b3a-4bc1-8c49-67e4e1887b3a}' = '"%ALLUSERSPROFILE%\Package Cache\{817e21c1-6b3a-4bc1-8c49-67e4e1887b3a}\VC_red...
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{2d507699-404c-4c8b-a54a-38e352f32cdd}' = '"%ALLUSERSPROFILE%\Package Cache\{2d507699-404c-4c8b-a54a-38e352f32cdd}\VC_red...
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\vcredist_x86.exe
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\3082\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\2052\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\2052\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1055\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1055\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1049\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1049\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1046\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1046\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1045\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1045\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1042\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1042\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1041\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1041\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1040\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1040\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1036\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1036\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1031\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1031\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\3082\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\bootstrapperapplicationdata.xml
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\vcruntimeadditional_x64
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\vcruntimeminimum_x64
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\windows7_msu_x64
- %ALLUSERSPROFILE%\package cache\{2d507699-404c-4c8b-a54a-38e352f32cdd}\state.rsm
- %ALLUSERSPROFILE%\package cache\{2d507699-404c-4c8b-a54a-38e352f32cdd}\vc_redist.x64.exe
- %WINDIR%\softwaredistribution\scanfile\05fc222d-bee0-45e7-b4a5-a454d56d6fa7\package.cab
- %WINDIR%\softwaredistribution\scanfile\05fc222d-bee0-45e7-b4a5-a454d56d6fa7\source.cab
- C:\f1318eb024f0588385cc\$dpx$.tmp\fa59a05434983548ab957f4e19f4bad2.tmp
- C:\f1318eb024f0588385cc\$dpx$.tmp\c1a1dbd86752714bb03d7da878282886.tmp
- C:\f1318eb024f0588385cc\$dpx$.tmp\89f9b0b14c62a1499d993dbf9e20e140.tmp
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\3082\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\cabb3e1576d1fefbb979e13b1a5379e0b16
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\cab54a5cabbe7274d8a22eb58060aab7623
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\vcruntimeadditional_x86
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\vcruntimeminimum_x86
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\windows7_msu_x64
- %ALLUSERSPROFILE%\package cache\{817e21c1-6b3a-4bc1-8c49-67e4e1887b3a}\state.rsm
- %ALLUSERSPROFILE%\package cache\{817e21c1-6b3a-4bc1-8c49-67e4e1887b3a}\vc_redist.x86.exe
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.be\vc_redist.x64.exe
- %TEMP%\dd_vcredist_amd64_20220617213326.log
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1029\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1029\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1028\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1041\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1040\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1040\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1036\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1036\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1031\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1031\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1029\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1029\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1028\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1028\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\logo.png
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\thm.xml
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\wixstdba.dll
- %WINDIR%\temp\{b19c008b-e1d6-4f8f-a818-afa7c26d87ba}\.cr\vcredist_x86.exe
- %TEMP%\vcredist_x64.exe
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1042\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1042\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1041\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1045\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\1028\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1045\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\license.rtf
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\logo.png
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\thm.wxl
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\thm.xml
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.ba\wixstdba.dll
- %WINDIR%\temp\{c0f630c8-03b7-470e-b74c-69de65d231ab}\.cr\vcredist_x64.exe
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.be\vc_redist.x86.exe
- %TEMP%\dd_vcredist_x86_20220617213321.log
- C:\f1318eb024f0588385cc\$dpx$.tmp\dd457adcbb32cd4b9bd1166955e04056.tmp
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\cab5046a8ab272bf37297bb7928664c9503
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\3082\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\2052\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\2052\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1055\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1055\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1049\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1049\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1046\license.rtf
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\1046\thm.wxl
- %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.ba\bootstrapperapplicationdata.xml
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\cab2c04ddc374bd96eb5c8eb8208f2c7c92
Deletes the following files
- %WINDIR%\softwaredistribution\scanfile\05fc222d-bee0-45e7-b4a5-a454d56d6fa7\source.cab
- %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\windows7_msu_x64
Moves the following files
- from %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\windows7_msu_x64 to %ALLUSERSPROFILE%\package cache\.unverified\windows7_msu_x64
- from %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x64 to %ALLUSERSPROFILE%\package cache\{38624eb5-356d-4b08-8357-c33d89a5c0c5}v14.32.31326\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi
- from %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\vcruntimeadditional_x64 to %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x64
- from %ALLUSERSPROFILE%\package cache\.unverified\cab5046a8ab272bf37297bb7928664c9503 to %ALLUSERSPROFILE%\package cache\{c96241ea-9900-4fe8-85b3-1e238d509df6}v14.32.31326\packages\vcruntimeminimum_amd64\cab1.cab
- from %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\cab5046a8ab272bf37297bb7928664c9503 to %ALLUSERSPROFILE%\package cache\.unverified\cab5046a8ab272bf37297bb7928664c9503
- from %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x64 to %ALLUSERSPROFILE%\package cache\{c96241ea-9900-4fe8-85b3-1e238d509df6}v14.32.31326\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi
- from %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\vcruntimeminimum_x64 to %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x64
- from C:\f1318eb024f0588385cc\$dpx$.tmp\fa59a05434983548ab957f4e19f4bad2.tmp to C:\f1318eb024f0588385cc\windows6.1-kb2999226-x64.xml
- from C:\f1318eb024f0588385cc\$dpx$.tmp\c1a1dbd86752714bb03d7da878282886.tmp to C:\f1318eb024f0588385cc\windows6.1-kb2999226-x64-pkgproperties.txt
- from C:\f1318eb024f0588385cc\$dpx$.tmp\dd457adcbb32cd4b9bd1166955e04056.tmp to C:\f1318eb024f0588385cc\windows6.1-kb2999226-x64.cab
- from C:\f1318eb024f0588385cc\$dpx$.tmp\89f9b0b14c62a1499d993dbf9e20e140.tmp to C:\f1318eb024f0588385cc\wsusscan.cab
- from %ALLUSERSPROFILE%\package cache\.unverified\cabb3e1576d1fefbb979e13b1a5379e0b16 to %ALLUSERSPROFILE%\package cache\{a250e750-db3f-40c1-8460-8ef77c7582da}v14.32.31326\packages\vcruntimeadditional_x86\cab1.cab
- from %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\cabb3e1576d1fefbb979e13b1a5379e0b16 to %ALLUSERSPROFILE%\package cache\.unverified\cabb3e1576d1fefbb979e13b1a5379e0b16
- from %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x86 to %ALLUSERSPROFILE%\package cache\{a250e750-db3f-40c1-8460-8ef77c7582da}v14.32.31326\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi
- from %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\vcruntimeadditional_x86 to %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x86
- from %ALLUSERSPROFILE%\package cache\.unverified\cab54a5cabbe7274d8a22eb58060aab7623 to %ALLUSERSPROFILE%\package cache\{46e11e7f-01e1-44d0-bb86-c67342d253dd}v14.32.31326\packages\vcruntimeminimum_x86\cab1.cab
- from %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\cab54a5cabbe7274d8a22eb58060aab7623 to %ALLUSERSPROFILE%\package cache\.unverified\cab54a5cabbe7274d8a22eb58060aab7623
- from %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x86 to %ALLUSERSPROFILE%\package cache\{46e11e7f-01e1-44d0-bb86-c67342d253dd}v14.32.31326\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi
- from %WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\vcruntimeminimum_x86 to %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x86
- from %ALLUSERSPROFILE%\package cache\.unverified\windows7_msu_x64 to %ALLUSERSPROFILE%\package cache\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\packages\patch\x64\windows6.1-kb2999226-x64.msu
- from %WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\cab2c04ddc374bd96eb5c8eb8208f2c7c92 to %ALLUSERSPROFILE%\package cache\.unverified\cab2c04ddc374bd96eb5c8eb8208f2c7c92
- from %ALLUSERSPROFILE%\package cache\.unverified\cab2c04ddc374bd96eb5c8eb8208f2c7c92 to %ALLUSERSPROFILE%\package cache\{38624eb5-356d-4b08-8357-c33d89a5c0c5}v14.32.31326\packages\vcruntimeadditional_amd64\cab1.cab
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
- 'ak#.ms':443
- 'download.visualstudio.microsoft.com':443
TCP
Other
- 'ra#.####ubusercontent.com':443
- 'ak#.ms':443
- 'download.visualstudio.microsoft.com':443
UDP
- DNS ASK ra#.####ubusercontent.com
- DNS ASK ak#.ms
- DNS ASK download.visualstudio.microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\vcredist_x86.exe' /install /quiet /norestart
- '%WINDIR%\temp\{b19c008b-e1d6-4f8f-a818-afa7c26d87ba}\.cr\vcredist_x86.exe' -burn.clean.room="%TEMP%\vcredist_x86.exe" -burn.filehandle.attached=192 -burn.filehandle.self=200 /install /quiet /norestart
- '%WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.be\vc_redist.x86.exe' -q -burn.elevated BurnPipe.{1D98809D-BE64-42CC-923F-1F29F5F44670} {44995844-2FC8-4CB2-B4BD-8FD5C2FE54C2} 2960
- '%TEMP%\vcredist_x64.exe' /install /quiet /norestart
- '%WINDIR%\temp\{c0f630c8-03b7-470e-b74c-69de65d231ab}\.cr\vcredist_x64.exe' -burn.clean.room="%TEMP%\vcredist_x64.exe" -burn.filehandle.attached=192 -burn.filehandle.self=200 /install /quiet /norestart
- '%WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.be\vc_redist.x64.exe' -q -burn.elevated BurnPipe.{AF71EBDC-9A99-4B8A-9949-3E870B4C44B3} {809DF9A8-8999-4E41-B270-99D506AA3953} 2552
- '%WINDIR%\syswow64\cmd.exe' /C NetSh Advfirewall Set allprofiles state off' (with hidden window)
- '%WINDIR%\temp\{d93660d3-e2bb-45f0-9c3e-9ffbe6a9fa15}\.be\vc_redist.x86.exe' -q -burn.elevated BurnPipe.{1D98809D-BE64-42CC-923F-1F29F5F44670} {44995844-2FC8-4CB2-B4BD-8FD5C2FE54C2} 2960' (with hidden window)
- '%WINDIR%\temp\{bc04f2ce-84cc-4de9-b803-fe73ac0c2264}\.be\vc_redist.x64.exe' -q -burn.elevated BurnPipe.{AF71EBDC-9A99-4B8A-9949-3E870B4C44B3} {809DF9A8-8999-4E41-B270-99D506AA3953} 2552' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C NetSh Advfirewall Set allprofiles state off
- '%WINDIR%\syswow64\netsh.exe' Advfirewall Set allprofiles state off
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\780B100', '%TEMP%\', '\\localhost\C$\Users\user\AppData\Local\780B100', '\\localhost\C$\Users\user\AppData\Local\Temp'"
- '<SYSTEM32>\wusa.exe' "%ALLUSERSPROFILE%\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu" /quiet /norestart
