Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Savings Vault-repairJob' = 'wscript.exe "<LS_APPDATA>\Savings Vault\repair.js" "Savings Vault-repairJob"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'BService' = '%ProgramFiles(x86)%\Bench\BService\bservice.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Wd' = '%ProgramFiles(x86)%\Bench\Wd\wd.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Savings Vault' = ''
Creates or modifies the following files
- %WINDIR%\tasks\bench-sys.job
- <SYSTEM32>\tasks\bench-sys
- %WINDIR%\tasks\bench-s-1-5-21-1960123792-2022915161-3775307078-1001.job
- <SYSTEM32>\tasks\bench-s-1-5-21-1960123792-2022915161-3775307078-1001
Modifies file system
Creates the following files
- %TEMP%\nsjceb2.tmp
- %ProgramFiles(x86)%\bench\wd\wd.exe
- %ProgramFiles(x86)%\bench\bservice\bservice.exe
- %ProgramFiles(x86)%\bench\bservice\bhelper.dll
- <LS_APPDATA>\savings vault\repair_data.json
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %ProgramFiles(x86)%\bench\nmhost\data\installer\ajgnadhkglnmmilocdmlpdbkppdiheid
- %ProgramFiles(x86)%\bench\nmhost\manifest.json
- %ProgramFiles(x86)%\bench\nmhost\nmhost.exe
- <LS_APPDATA>\savings vault\chrome_gp_update.js
- <LS_APPDATA>\savings vault\chrome_installer.js
- <LS_APPDATA>\savings vault\gpedit.exe
- %TEMP%\nsycec2.tmp\nsprocess.dll
- %ProgramFiles(x86)%\bench\updater\products.xml
- %TEMP%\nsy1da.tmp
- <LS_APPDATA>\savings vault\uninstall.exe
- %TEMP%\nsy1d9.tmp
- %ProgramFiles(x86)%\bench\updater\updater.exe
- <LS_APPDATA>\savings vault\repair.js
- <LS_APPDATA>\savings vault\migrate.js
- <LS_APPDATA>\savings vault\info.xml
- <LS_APPDATA>\savings vault\main_installer.js
- <LS_APPDATA>\savings vault\icon.ico
- <LS_APPDATA>\savings vault\common.js
- <LS_APPDATA>\savings vault\installer.js
- <LS_APPDATA>\savings vault\projectinstaller.js
- <LS_APPDATA>\savings vault\softwaredetector.exe
- %TEMP%\nsycec2.tmp\nsexec.dll
- %TEMP%\nsycec2.tmp\md5dll.dll
- %TEMP%\nsycec2.tmp\system.dll
- %TEMP%\nsycec2.tmp\ping.js
- %ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe
- <LS_APPDATA>\benchupdater\products.xml
Deletes the following files
- %TEMP%\nsy1da.tmp
- <LS_APPDATA>\savings vault\info.xml
- %TEMP%\nsycec2.tmp\md5dll.dll
- %TEMP%\nsycec2.tmp\nsexec.dll
- %TEMP%\nsycec2.tmp\nsprocess.dll
- %TEMP%\nsycec2.tmp\ping.js
- %TEMP%\nsycec2.tmp\system.dll
Substitutes the following files
- %PROGRAMDATA%\ntuser.pol
Modifies the HOSTS file.
Network activity
UDP
- DNS ASK in###ll-trk.com
- DNS ASK se####.update-srv.info
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addsystask
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addproduct -info="<LS_APPDATA>\Savings Vault\info.xml"
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addtask
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addproduct -info="%TEMP%\nsy1DA.tmp"
- '%ProgramFiles(x86)%\bench\updater\1.7.0.0\updater.exe' -runmode=addproduct -info="%TEMP%\nsy1DA.tmp"
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addtask
- '<LS_APPDATA>\savings vault\softwaredetector.exe'
- '%ProgramFiles(x86)%\bench\updater\updater.exe' -runmode=addproduct -info="<LS_APPDATA>\Savings Vault\info.xml"
- '<LS_APPDATA>\savings vault\gpedit.exe' chrome add-extension ajgnadhkglnmmilocdmlpdbkppdiheid http://aj########nmmilocdmlpdbkppdiheid/check/.eJwNikkOgCAMAP_SMzF65TOm0gYqZQmgMTH-XY6zvDCwR7DgQiuJwcDNrUvJU23LOllyH6jKDexoFxvgZ-xCs-PpM1KI...
- '%ProgramFiles(x86)%\bench\bservice\bservice.exe'
- '%ProgramFiles(x86)%\bench\wd\wd.exe'
- '%WINDIR%\syswow64\net.exe' start schedule' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "chrome_gp_update.js" /product-name="Savings Vault" /installation-time=1570229002 /pid=1860 /zone=486366 /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /app-id="38934" /chromeinfo=".e...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" http://www.in###ll-trk.com/installer-run/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/xriderexe/486366/?pi###############################################...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "migrate.js" /iversion=20140221 /programfiles="%ProgramFiles(x86)%" /localapps="<LS_APPDATA>" /chrome-dir="" /product-name="Savings Vault" /installation-time=1570229002 /pid=1860 /zon...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install chrome "" /product-name="Savings Vault" /installation-time=1570229002 /pid=1860 /zone=486366 /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /app-id="38934" /chr...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" http://www.in###ll-trk.com/tbi-ping/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/xriderexe/486366/?pi##################################################' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "main_installer.js" install /product-name="Savings Vault" /installation-time=1570229002 /pid=1860 /zone=486366 /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /app-id="38934" /chromein...' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" http://www.in###ll-trk.com/newuser-ping/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/0/xriderexe/486366/0/?pi############################################...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" http://www.in###ll-trk.com/installer-run/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/xriderexe/486366/?pi###############################################...
- '%WINDIR%\syswow64\net.exe' start schedule
- '%WINDIR%\syswow64\net1.exe' start schedule
- '%WINDIR%\syswow64\cscript.exe' //Nologo "main_installer.js" install /product-name="Savings Vault" /installation-time=1570229002 /pid=1860 /zone=486366 /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /app-id="38934" /chromein...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "installer.js" install chrome "" /product-name="Savings Vault" /installation-time=1570229002 /pid=1860 /zone=486366 /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /app-id="38934" /chr...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "chrome_gp_update.js" /product-name="Savings Vault" /installation-time=1570229002 /pid=1860 /zone=486366 /nmhost-dir="%ProgramFiles(x86)%\Bench\NmHost" /app-id="38934" /chromeinfo=".e...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "migrate.js" /iversion=20140221 /programfiles="%ProgramFiles(x86)%" /localapps="<LS_APPDATA>" /chrome-dir="" /product-name="Savings Vault" /installation-time=1570229002 /pid=1860 /zon...
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" http://www.in###ll-trk.com/tbi-ping/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/xriderexe/486366/?pi##################################################
- '%WINDIR%\syswow64\cscript.exe' //Nologo "ping.js" http://www.in###ll-trk.com/newuser-ping/0af8eb8e6f9835a09b24a4fc8298d2f0/69049eaaea3e98c5e6703d3d05cad1a1/0/xriderexe/486366/0/?pi############################################...
- '<SYSTEM32>\raserver.exe' /offerraupdate
