Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\DrawDesign\Shell\Open\Command] '' = '"<Full path to file>" "%1"'
Modifies file system
Creates the following files
- D:\drawdesignupgrade.exe
- %TEMP%\kdvn2fy3.0.cs
- %TEMP%\kdvn2fy3.cmdline
- %TEMP%\kdvn2fy3.out
- %TEMP%\cscf.tmp
- %TEMP%\res10.tmp
- %TEMP%\kdvn2fy3.dll
- D:\drawdesign\def.ttf
Deletes the following files
- %TEMP%\res10.tmp
- %TEMP%\cscf.tmp
- %TEMP%\kdvn2fy3.0.cs
- %TEMP%\kdvn2fy3.cmdline
- %TEMP%\kdvn2fy3.out
- %TEMP%\kdvn2fy3.dll
- D:\drawdesignupgrade.exe
Network activity
Connects to
- '47.##7.45.180':7979
TCP
HTTP POST requests
- http://47.###.45.180:7979/tran via 47.##7.45.180
Miscellaneous
Creates and executes the following
- 'D:\drawdesignupgrade.exe' "<Full path to file>"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kdvn2fy3.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10.tmp" "%TEMP%\CSCF.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\kdvn2fy3.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES10.tmp" "%TEMP%\CSCF.tmp"
