Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\java updater
Modifies file system
Creates the following files
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %PROGRAMDATA%\msvcp100.dll
- %APPDATA%\invoice template.pdf
- %PROGRAMDATA%\client.exe
- %APPDATA%\microsoft\windows\start menu\programs\invoice\quasar.lnk
- %APPDATA%\winrar\02-15-2020
Deletes the following files
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
Network activity
Connects to
- '<LOCALNET>.174.1':443
- '37.##1.113.170':443
TCP
HTTP GET requests
- http://ip##pi.com/json/
UDP
- DNS ASK ip##pi.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1911330 "__IRAFN:<Full path to file>" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-1960123792-2022915161-3775307078-1001"
- '%PROGRAMDATA%\client.exe'
Executes the following
- '%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "%APPDATA%\invoice template.pdf"
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "Java Updater" /sc ONLOGON /tr "%PROGRAMDATA%\Client.exe" /rl HIGHEST /f
