Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Windows Service Management] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Windows Service Management] 'ImagePath' = '"<SYSTEM32>\wsm.exe"'
- [HKLM\System\CurrentControlSet\Services\Group Policy Management] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Group Policy Management] 'ImagePath' = '"<SYSTEM32>\GMS.exe"'
Creates the following services
- 'Windows Service Management' "<SYSTEM32>\wsm.exe"
- 'Windows Service Management' <SYSTEM32>\wsm.exe
- 'Group Policy Management' "<SYSTEM32>\GMS.exe"
- 'Group Policy Management' <SYSTEM32>\GMS.exe
Modifies file system
Creates the following files
- C:\gdktemp\interop.netfwtypelib.dll
- <SYSTEM32>\gms.installstate
- <SYSTEM32>\gms.installlog
- <SYSTEM32>\gms.exe
- <SYSTEM32>\wsm.installstate
- <SYSTEM32>\wsm.installlog
- C:\gdktemp\installutil.installlog
- <SYSTEM32>\wsm.exe
- <SYSTEM32>\mac.log
- C:\gdktemp\interop.iwshruntimelibrary.dll
- C:\gdktemp\installscansoft.exe
- C:\g-desk\paramlog.log
- C:\gdktemp\gms.exe
- C:\gdktemp\g-desk.exe.config
- C:\gdktemp\g-desk.exe
- C:\gdktemp\detectscansoft.exe
- C:\gdktemp\wsm.exe
- C:\gdktemp\setupscansoft.exe.lnk
- C:\gdktemp\mystartup.exe
- C:\gdktemp\microsoft.win32.taskscheduler.xml
- C:\gdktemp\microsoft.win32.taskscheduler.dll
- C:\gdktemp\logo_gcs.ico
- C:\gdktemp\interop.wuapilib.dll
- C:\gdktemp\g-desk1.lnk
- <SYSTEM32>\servicerunning.log
Deletes the following files
- C:\gdktemp\wsm.exe
- C:\gdktemp\detectscansoft.exe
- C:\gdktemp\installscansoft.exe
- C:\gdktemp\installutil.installlog
- C:\gdktemp\microsoft.win32.taskscheduler.dll
- C:\gdktemp\setupscansoft.exe.lnk
Moves the following files
- from C:\gdktemp\interop.iwshruntimelibrary.dll to C:\g-desk\interop.iwshruntimelibrary.dll
- from C:\gdktemp\microsoft.win32.taskscheduler.xml to C:\g-desk\microsoft.win32.taskscheduler.xml
- from C:\gdktemp\interop.netfwtypelib.dll to C:\g-desk\interop.netfwtypelib.dll
- from C:\gdktemp\interop.wuapilib.dll to C:\g-desk\interop.wuapilib.dll
- from C:\gdktemp\mystartup.exe to %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\g-desk_startup.exe
- from C:\gdktemp\g-desk.exe to C:\g-desk\g-desk.exe
- from C:\gdktemp\g-desk.exe.config to C:\g-desk\g-desk.exe.config
- from C:\gdktemp\g-desk1.lnk to C:\users\public\desktop\g-desk.lnk
- from C:\gdktemp\logo_gcs.ico to C:\g-desk\logo_gcs.ico
- from C:\gdktemp\gms.exe to C:\g-desk\gms.exe
Network activity
Connects to
- 'ss.###ersoft-vn.com':443
TCP
Other
- 'ss.###ersoft-vn.com':443
UDP
- DNS ASK ss.###ersoft-vn.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\gdktemp\detectscansoft.exe'
- 'C:\gdktemp\installscansoft.exe'
- '<SYSTEM32>\wsm.exe'
- '<SYSTEM32>\gms.exe'
- 'C:\g-desk\g-desk.exe'
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\installutil.exe' /i <SYSTEM32>\wsm.exe
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\installutil.exe' /i <SYSTEM32>\GMS.exe
