Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\tcpsvcs.exe
Modifies file system
Creates the following files
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\7152730903b0a2614828ce65eea2c567a483b4ea3371b9f372b47b63f0d35def\48a8fc459c5ffb1f1bd89ab4fdb6517b8f9921558836e21e92d900dc0a35052a.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\b4f592d2a2c55fbbc58672fbc1f62742542344527e3ec036e7dddb9659acf241\1abfb9d782f2137491817081d68112453de11b6d355ed5fb5eb410fc9a6cd729.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\b9d10432d0f613b26b356a2d3dee8de08c4de18269dc93ad0d117bf807ad0ee7\baec7a32c003252df5c45c17b4ae348fa20a317c1bb5c15639133d51766ae88c.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\3d5c2ed07bc5e0db1da06481fe16b3a8ad8d0ffd910d52de5757c7f61e39b9ba\26547313f27f14fabb960df9bb5a20532152b52389ba2d6fa895afc1a5e78061.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\7becf7b3fa9fee72c646dd394557b62c5935a5e2baa122ea11daa7018f4edf8a\baec7a32c003252df5c45c17b4ae348fa20a317c1bb5c15639133d51766ae88c.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\b4c90236b2684af924c4a6f1e7b28355e0a0f348716298f5b1babcf32e9bfb5e\ae2a32d8ef7540d38835c950120ac4e2caf6c4914d097c2a72ff988365780096.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\af83b596343cd54a4518ac0801ded9022728d1ed8ed9fb2c2cb28e172a37c0d1\e4083125034e2a52effb405f07f0fb1a74301de5a7c838f69ebd82d7a612c774.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\39b7b76ad5d0d51477e0fe142eec40f4f2b02930d59981a79c80cf3d749456c3\ba7b955bedf5db774311ed53726bf67d1af01bbdd307c04c67ed9f4484528b3b.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\4222b48966130497fe7619064a45ad51d96e047cd203364ff7e580ea83ade055\41b0d53f2f9c46f4825d93cc4745f30cf166d78212eb1a4401849ecbc55bf784.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\9f41da2f9c21ae43ae7b32b62f2e5b7e4e7583df29f17d787ff0d0afcfa68a4b\45f8b792e24eb5bb9187e200c85f011fb4adf9ccff599940b70a5f6e72e144ca.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\ddbdae303019de5d0898d1cbd8d54c8309e69160c2c4687036c7fcc002952b7d\68888a98c462ea1b8ea0abfbd8dd7d50fbb1fac722312616ebfbad990b0b3d4e.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\2dcc131c882cd8ad3c60dd68e1c34edd7cb426131066e95a2070a4f4f20419ec\f24ce620baaff988a3826070a65435305c272be750077d46e6c01e8e42d7ccc6.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\45618b70379074d5fdb4e745ac9c6465c1dd87d6691007835d04be78a4f043a8\691ad952241c300daa8316e046d4c8e1185c6d5df106729fea1690f675db8dd4.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\27049e28d280ba52e9103fe5dcbf5807e159a18d5f9c7d758ef156ab8e03222a\e9153702a1e81585e0f223877f2bb07313aaaeb1729e6b2ed454959c92c0be18.inprogress
- %TEMP%\ff3ef9353cc449a49582f3784a729fd8\0a83d8132ad80aee06c1bb10a03dbeb96889f74a67dcb35653420bca0c78f469\b922b539a1407f7838eccf80dbe0dfe5e9fc37c45e4d83bc9d5f58f1a9fc08c7.inprogress
Moves the following files
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\7152730903b0a2614828ce65eea2c567a483b4ea3371b9f372b47b63f0d35def\48a8fc459c5ffb1f1bd89ab4fdb6517b8f9921558836e21e92d900dc0a35052a.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\7152730903b0a2614828ce65eea2c567a483b4ea3371b9f372b47b63f0d35def\48a8fc459c5ffb1f1bd89ab4fdb6517b8f9921558836e21e92d900dc0a35052a
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\b4f592d2a2c55fbbc58672fbc1f62742542344527e3ec036e7dddb9659acf241\1abfb9d782f2137491817081d68112453de11b6d355ed5fb5eb410fc9a6cd729.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\b4f592d2a2c55fbbc58672fbc1f62742542344527e3ec036e7dddb9659acf241\1abfb9d782f2137491817081d68112453de11b6d355ed5fb5eb410fc9a6cd729
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\b9d10432d0f613b26b356a2d3dee8de08c4de18269dc93ad0d117bf807ad0ee7\baec7a32c003252df5c45c17b4ae348fa20a317c1bb5c15639133d51766ae88c.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\b9d10432d0f613b26b356a2d3dee8de08c4de18269dc93ad0d117bf807ad0ee7\baec7a32c003252df5c45c17b4ae348fa20a317c1bb5c15639133d51766ae88c
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\3d5c2ed07bc5e0db1da06481fe16b3a8ad8d0ffd910d52de5757c7f61e39b9ba\26547313f27f14fabb960df9bb5a20532152b52389ba2d6fa895afc1a5e78061.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\3d5c2ed07bc5e0db1da06481fe16b3a8ad8d0ffd910d52de5757c7f61e39b9ba\26547313f27f14fabb960df9bb5a20532152b52389ba2d6fa895afc1a5e78061
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\7becf7b3fa9fee72c646dd394557b62c5935a5e2baa122ea11daa7018f4edf8a\baec7a32c003252df5c45c17b4ae348fa20a317c1bb5c15639133d51766ae88c.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\7becf7b3fa9fee72c646dd394557b62c5935a5e2baa122ea11daa7018f4edf8a\baec7a32c003252df5c45c17b4ae348fa20a317c1bb5c15639133d51766ae88c
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\b4c90236b2684af924c4a6f1e7b28355e0a0f348716298f5b1babcf32e9bfb5e\ae2a32d8ef7540d38835c950120ac4e2caf6c4914d097c2a72ff988365780096.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\b4c90236b2684af924c4a6f1e7b28355e0a0f348716298f5b1babcf32e9bfb5e\ae2a32d8ef7540d38835c950120ac4e2caf6c4914d097c2a72ff988365780096
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\af83b596343cd54a4518ac0801ded9022728d1ed8ed9fb2c2cb28e172a37c0d1\e4083125034e2a52effb405f07f0fb1a74301de5a7c838f69ebd82d7a612c774.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\af83b596343cd54a4518ac0801ded9022728d1ed8ed9fb2c2cb28e172a37c0d1\e4083125034e2a52effb405f07f0fb1a74301de5a7c838f69ebd82d7a612c774
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\39b7b76ad5d0d51477e0fe142eec40f4f2b02930d59981a79c80cf3d749456c3\ba7b955bedf5db774311ed53726bf67d1af01bbdd307c04c67ed9f4484528b3b.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\39b7b76ad5d0d51477e0fe142eec40f4f2b02930d59981a79c80cf3d749456c3\ba7b955bedf5db774311ed53726bf67d1af01bbdd307c04c67ed9f4484528b3b
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\4222b48966130497fe7619064a45ad51d96e047cd203364ff7e580ea83ade055\41b0d53f2f9c46f4825d93cc4745f30cf166d78212eb1a4401849ecbc55bf784.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\4222b48966130497fe7619064a45ad51d96e047cd203364ff7e580ea83ade055\41b0d53f2f9c46f4825d93cc4745f30cf166d78212eb1a4401849ecbc55bf784
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\9f41da2f9c21ae43ae7b32b62f2e5b7e4e7583df29f17d787ff0d0afcfa68a4b\45f8b792e24eb5bb9187e200c85f011fb4adf9ccff599940b70a5f6e72e144ca.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\9f41da2f9c21ae43ae7b32b62f2e5b7e4e7583df29f17d787ff0d0afcfa68a4b\45f8b792e24eb5bb9187e200c85f011fb4adf9ccff599940b70a5f6e72e144ca
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\ddbdae303019de5d0898d1cbd8d54c8309e69160c2c4687036c7fcc002952b7d\68888a98c462ea1b8ea0abfbd8dd7d50fbb1fac722312616ebfbad990b0b3d4e.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\ddbdae303019de5d0898d1cbd8d54c8309e69160c2c4687036c7fcc002952b7d\68888a98c462ea1b8ea0abfbd8dd7d50fbb1fac722312616ebfbad990b0b3d4e
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\2dcc131c882cd8ad3c60dd68e1c34edd7cb426131066e95a2070a4f4f20419ec\f24ce620baaff988a3826070a65435305c272be750077d46e6c01e8e42d7ccc6.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\2dcc131c882cd8ad3c60dd68e1c34edd7cb426131066e95a2070a4f4f20419ec\f24ce620baaff988a3826070a65435305c272be750077d46e6c01e8e42d7ccc6
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\45618b70379074d5fdb4e745ac9c6465c1dd87d6691007835d04be78a4f043a8\691ad952241c300daa8316e046d4c8e1185c6d5df106729fea1690f675db8dd4.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\45618b70379074d5fdb4e745ac9c6465c1dd87d6691007835d04be78a4f043a8\691ad952241c300daa8316e046d4c8e1185c6d5df106729fea1690f675db8dd4
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\27049e28d280ba52e9103fe5dcbf5807e159a18d5f9c7d758ef156ab8e03222a\e9153702a1e81585e0f223877f2bb07313aaaeb1729e6b2ed454959c92c0be18.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\27049e28d280ba52e9103fe5dcbf5807e159a18d5f9c7d758ef156ab8e03222a\e9153702a1e81585e0f223877f2bb07313aaaeb1729e6b2ed454959c92c0be18
- from %TEMP%\ff3ef9353cc449a49582f3784a729fd8\0a83d8132ad80aee06c1bb10a03dbeb96889f74a67dcb35653420bca0c78f469\b922b539a1407f7838eccf80dbe0dfe5e9fc37c45e4d83bc9d5f58f1a9fc08c7.inprogress to %TEMP%\ff3ef9353cc449a49582f3784a729fd8\0a83d8132ad80aee06c1bb10a03dbeb96889f74a67dcb35653420bca0c78f469\b922b539a1407f7838eccf80dbe0dfe5e9fc37c45e4d83bc9d5f58f1a9fc08c7
Network activity
TCP
HTTP GET requests
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4.crt
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\tcpsvcs.exe'
