Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\CLSID\{AF904382-7E87-4348-89AA-99C0CC8A698C}\Shell\Open\Command] '' = '%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcMgr.exe /Settings'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\LumiDvcSvc] 'ImagePath' = '%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcSvc.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\LumiDvcSvc] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\InstallLumidigmDriver.exe' 0 "C:\\Program Files\\Lumidigm\\LumiDeviceServiceDeployment v4.10.33\\"
- '%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\dpinst.exe' "/q"
- 'C:\Utilities\Lumidigm 4.10.33\Demo\LumiDemoSetup_4.10.33.exe' /S /v/qn
- 'C:\Utilities\Lumidigm 4.10.33\Drivers\LumiDvcSvcDeployment_4.10.33.exe' /S /v/qn
- '%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcSvc.exe' -i
- '%ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcSvc.exe'
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding 34564715AD0980E9A48147C127CA1C17 M Global\MSI0000
- '<SYSTEM32>\cmd.exe' /c ""C:\\Program Files\\Lumidigm\\LumiDeviceServiceDeployment v4.10.33\\Driver\Drivers_XP_x86\dpinst.exe" "/q""
- '<SYSTEM32>\msiexec.exe' -Embedding B4044D45DF20A7E5DF78A3222E6E50D9 C
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 5127CFF815DCDC894E43960F1BC7B738 C
- '<SYSTEM32>\msiexec.exe' -Embedding 85297680D557A4324D81C452BB293133
Modifies file system:
Creates the following files:
- %TEMP%\~DFD8C6.tmp
- %WINDIR%\Installer\{246DF214-653A-46EC-A601-C5D513065BAF}\Lumidigm_Device_Se_65779FE85AD84242AAFF45F3246D1BA4.exe
- %WINDIR%\DPINST.LOG
- %WINDIR%\Installer\MSI1B.tmp
- %WINDIR%\Installer\{246DF214-653A-46EC-A601-C5D513065BAF}\NewShortcut2_18ABBA177FB14A1BA40143F8612BE572.exe
- %WINDIR%\Installer\{246DF214-653A-46EC-A601-C5D513065BAF}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\{246DF214-653A-46EC-A601-C5D513065BAF}\Lumidigm_Device_Se_1FC36F81AA7A425993AF1385D6125063.exe
- %WINDIR%\Installer\{246DF214-653A-46EC-A601-C5D513065BAF}\NewShortcut3_06FDE5D3910A4D2F828B64452A4DD917.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\D41693DAFE5DEF0C36959FF1FCEF5C96
- <SYSTEM32>\DRVSTORE\lumidriver_1530586A92F72AC0B2E9DC468967B800776348E2\lumidriver.inf
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D
- <SYSTEM32>\DRVSTORE\lumidriver_1530586A92F72AC0B2E9DC468967B800776348E2\LumiDriver.sys
- <SYSTEM32>\DRVSTORE\lumidriver_1530586A92F72AC0B2E9DC468967B800776348E2\LUMIDRIVER.cat
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\207B9FD92391B9B2A60A89B4C965D5DF
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\D41693DAFE5DEF0C36959FF1FCEF5C96
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\207B9FD92391B9B2A60A89B4C965D5DF
- %WINDIR%\Installer\2c898.msi
- <SYSTEM32>\plugin\VenusDvc.dll
- <SYSTEM32>\SPM\SPM_1.bin
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\M31X.hex
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\V31X.hex
- <SYSTEM32>\plugin\MercuryDvc.dll
- <SYSTEM32>\LumiInOpAPI.dll
- <SYSTEM32>\plugin\SDvc.dll
- <SYSTEM32>\plugin\PreProcV21_INT16.dll
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\InstallLumidigmDriver.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Lumidigm\Lumidigm Device Service Deployment v4.10.33\Lumidigm Device Service Deployment Overview.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Lumidigm\Lumidigm Device Service Deployment v4.10.33\Lumidigm Streaming Device Config.lnk
- %WINDIR%\Installer\MSI19.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Lumidigm\Lumidigm Device Service Deployment v4.10.33\Lumidigm Device Service Migration Overview.lnk
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\doc\Lumidigm Device Service Deployment v4.10.pdf
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\doc\Lumidigm Device Service Migration v4.10.pdf
- %ALLUSERSPROFILE%\Start Menu\Programs\Lumidigm\Lumidigm Device Service Deployment v4.10.33\Lumidigm Device Manager.lnk
- %WINDIR%\Installer\$PatchCache$\Managed\412FD642A356CE646A105C5D3160B5FA\4.10.33\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- <LS_APPDATA>\Downloaded Installations\{CF885630-5CB1-4547-BFB3-3643DAB42D70}\0x0409.ini
- <LS_APPDATA>\Downloaded Installations\{CF885630-5CB1-4547-BFB3-3643DAB42D70}\Lumidigm Demo v4.10.33.msi
- %TEMP%\~29.tmp
- %TEMP%\_is2A.tmp
- %TEMP%\_is27.tmp
- %TEMP%\~24.tmp
- %TEMP%\_is28.tmp
- %TEMP%\~26.tmp
- %TEMP%\_is2B.tmp
- %TEMP%\MSI31.tmp
- %TEMP%\_is30.tmp
- %TEMP%\f9c.rra
- %TEMP%\MSI32.tmp
- %TEMP%\_is2D.tmp
- %TEMP%\_is2C.tmp
- %TEMP%\_is2F.tmp
- %TEMP%\_is2E.tmp
- %TEMP%\_is25.tmp
- %TEMP%\_is1E.tmp
- %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\setu50a2.rra
- %TEMP%\_is1F.tmp
- %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\ISSetup.dll
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\Log.txt
- %ProgramFiles%\DIFX\37C35FE1F6CAE763\dpinst.exe
- %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\setup.ini
- C:\Utilities\Lumidigm 4.10.33\Demo\setup.iss
- %TEMP%\aut21.tmp
- %TEMP%\_is23.tmp
- %TEMP%\_is22.tmp
- C:\Utilities\Lumidigm 4.10.33\Drivers\setup.log
- %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\0x045ad3.rra
- C:\Utilities\Lumidigm 4.10.33\Demo\LumiDemoSetup_4.10.33.exe
- %TEMP%\aut20.tmp
- <SYSTEM32>\LumiCore.dll
- %TEMP%\a30c.rra
- %TEMP%\MSI13.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\_is10.tmp
- %TEMP%\_isF.tmp
- %TEMP%\MSI12.tmp
- %TEMP%\_is11.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- %TEMP%\_isE.tmp
- %TEMP%\_is4.tmp
- %TEMP%\_is3.tmp
- %TEMP%\~5.tmp
- %TEMP%\_is6.tmp
- C:\Utilities\Lumidigm 4.10.33\Drivers\LumiDvcSvcDeployment_4.10.33.exe
- %TEMP%\aut1.tmp
- C:\Utilities\Lumidigm 4.10.33\Drivers\setup.iss
- %TEMP%\aut2.tmp
- %TEMP%\_is8.tmp
- %TEMP%\~A.tmp
- %TEMP%\_isB.tmp
- %TEMP%\_isD.tmp
- %TEMP%\_isC.tmp
- %TEMP%\_is9.tmp
- %TEMP%\~7.tmp
- <LS_APPDATA>\Downloaded Installations\{2D99CEEA-EEDD-4A87-9584-0145EF9F11C7}\0x0409.ini
- <LS_APPDATA>\Downloaded Installations\{2D99CEEA-EEDD-4A87-9584-0145EF9F11C7}\LumiDeviceServiceDeployment v4.10.33.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\SEDevConfig.xml
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\SEngineCore.exe
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\lumidriver.cat
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\dpinst.exe
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcSvc.exe
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\dat\DefaultSEDevConfig.xml
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\SEDeviceConfig.exe
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\LumiDvcMgr.exe
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\LumiDriver.inf
- <SYSTEM32>\plugin\AlgoDvc.dll
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\bin\SPM\SPM_1.bin
- <SYSTEM32>\LumiAPI.dll
- <SYSTEM32>\plugin\IEngine_Plus.dll
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\DriverNonStr_WinXP_X86\bulkusb.inf
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\Driver\Drivers_XP_x86\LUMIDRIVER.sys
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\DriverNonStr_WinXP_X86\bulkusbx86.cat
- %ProgramFiles%\Lumidigm\LumiDeviceServiceDeployment v4.10.33\DriverNonStr_WinXP_X86\bulkldi.sys
- C:\Config.Msi\2c897.rbs
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %TEMP%\~DF8743.tmp
- %WINDIR%\Installer\2c896.ipi
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\2c895.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSI14.tmp
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Deletes the following files:
- %TEMP%\{C18D9B8F-B561-4322-8269-B4BBE5CF542E}\_ISMSIDEL.INI
- %TEMP%\{C18D9B8F-B561-4322-8269-B4BBE5CF542E}\Setup.INI
- %TEMP%\{C18D9B8F-B561-4322-8269-B4BBE5CF542E}\LumiDeviceServiceDeployment v4.10.33.msi
- %TEMP%\aut20.tmp
- %TEMP%\_is23.tmp
- %TEMP%\_is22.tmp
- %TEMP%\aut21.tmp
- %TEMP%\{C18D9B8F-B561-4322-8269-B4BBE5CF542E}\ISSetup.dll
- %TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\_isres_0x0409.dll
- %TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\String1033.txt
- %TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\ISRT.dll
- %TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\setup.exe
- %TEMP%\{C18D9B8F-B561-4322-8269-B4BBE5CF542E}\0x0409.ini
- %TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\EULA.rtf
- %TEMP%\{6DF9A273-1429-4958-BAB9-936EA4BA8CCD}\setup.inx
- %TEMP%\_is2E.tmp
- %TEMP%\_is2D.tmp
- %TEMP%\_is2C.tmp
- %TEMP%\_is2F.tmp
- %TEMP%\MSI32.tmp
- %TEMP%\MSI31.tmp
- %TEMP%\_is30.tmp
- %TEMP%\_is2B.tmp
- %TEMP%\_is27.tmp
- %TEMP%\~24.tmp
- %TEMP%\_is25.tmp
- %TEMP%\~26.tmp
- %TEMP%\~29.tmp
- %TEMP%\_is2A.tmp
- %TEMP%\_is28.tmp
- %TEMP%\~A.tmp
- %TEMP%\_isB.tmp
- %TEMP%\_is9.tmp
- %TEMP%\_isC.tmp
- %TEMP%\_isF.tmp
- %TEMP%\_isE.tmp
- %TEMP%\_isD.tmp
- %TEMP%\~7.tmp
- %TEMP%\_is3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\_is4.tmp
- %TEMP%\_is8.tmp
- %TEMP%\~5.tmp
- %TEMP%\_is6.tmp
- %WINDIR%\Installer\MSI1B.tmp
- C:\Config.Msi\2c897.rbs
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\2c895.msi
- %TEMP%\_is1F.tmp
- %TEMP%\_is1E.tmp
- %WINDIR%\Installer\2c896.ipi
- %WINDIR%\Installer\MSI19.tmp
- %TEMP%\MSI12.tmp
- %TEMP%\_is11.tmp
- %TEMP%\_is10.tmp
- %TEMP%\MSI13.tmp
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSI14.tmp
Moves the following files:
- from %TEMP%\a30c.rra to %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\Setup.ilg
- from %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\0x045ad3.rra to %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\0x0409.ini
- from %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\setu50a2.rra to %ProgramFiles%\InstallShield Installation Information\{246DF214-653A-46EC-A601-C5D513065BAF}\setup.exe
Network activity:
Connects to:
- '20#.#6.232.182':80
- 'wp#d':80
TCP:
HTTP GET requests:
- http://crl.microsoft.com/pki/crl/products/MicWinHarComPCA_2010-11-01.crl via 20#.#6.232.182
- http://crl.microsoft.com/pki/crl/products/tspca.crl via 20#.#6.232.182
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.microsoft.com/pki/crl/products/MicrosoftRootAuthority.crl via 20#.#6.232.182
UDP:
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
