Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\TopShape-B4 Service] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\TopShape-B4 Service] 'ImagePath' = '"%APPDATA%\TopShape-B4\SoftwareUpdate.exe" /run "/aff_id=1002" "/app_id=1"'
Modifies file system
Creates the following files
- %TEMP%\nseea9.tmp\system.dll
- %TEMP%\nseea9.tmp\nsexec.dll
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\cert8.db
- nul
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\key3.db
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\secmod.db
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\pkcs11.txt
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\cert9.db-journal
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\cert9.db
- %TEMP%\nseea9.tmp\ff\db\empty\secmod.db
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\key4.db-journal
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\pkcs11.txt
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cert9.db-journal
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cert9.db
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\key4.db-journal
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\key4.db
- %TEMP%\nseea9.tmp\nsprocess.dll
- %APPDATA%\topshape-b4\softwareupdate.exe
- %ProgramFiles(x86)%\topshape-b4\uninstall.exe
- %TEMP%\nseea9.tmp\ff\bin\sqlite3.dll
- %TEMP%\nseea9.tmp\ff\bin\ssl3.dll
- %TEMP%\nseea9.tmp\ff\bin\softokn3.dll
- %TEMP%\nseea9.tmp\ff\bin\smime3.dll
- %TEMP%\nseea9.tmp\ff\bin\plds4.dll
- %TEMP%\nseea9.tmp\nsis7z.dll
- %TEMP%\nseea9.tmp\ff\add-certs.cmd
- %TEMP%\nseea9.tmp\ff\bin\copying
- %TEMP%\nseea9.tmp\ff\bin\license
- %TEMP%\nseea9.tmp\ff\bin\readme.md
- %TEMP%\nseea9.tmp\ff\cacert\ca.cert.pem
- %TEMP%\nseea9.tmp\ff\certificate.cer
- %TEMP%\nseea9.tmp\ff\db\empty\cert8.db
- %TEMP%\nseea9.tmp\inetc.dll
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\key4.db
- %TEMP%\nseea9.tmp\ff\db\empty\key3.db
- %TEMP%\nseea9.tmp\ff\bin\freebl3.dll
- %TEMP%\nseea9.tmp\ff\bin\msvcr120.dll
- %TEMP%\nseea9.tmp\ff\bin\nspr4.dll
- %TEMP%\nseea9.tmp\ff\bin\nss3.dll
- %TEMP%\nseea9.tmp\ff\bin\nssckbi.dll
- %TEMP%\nseea9.tmp\ff\bin\nssdbm3.dll
- %TEMP%\nseea9.tmp\ff\bin\nssutil3.dll
- %TEMP%\nseea9.tmp\ff\bin\plc4.dll
- %TEMP%\nseea9.tmp\ff\firefox.7z
- %TEMP%\nseea9.tmp\ff\bin\certutil.exe
- C:\end
Deletes the following files
- %TEMP%\nseea9.tmp\ff\firefox.7z
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\cert9.db-journal
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\key4.db-journal
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cert9.db-journal
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\key4.db-journal
- C:\end
Substitutes the following files
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\cert9.db-journal
- %ProgramFiles(x86)%\mozilla firefox\browser\defaults\profile\key4.db-journal
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cert9.db-journal
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\key4.db-journal
Modifies the HOSTS file.
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK google.com
- DNS ASK microsoft.com
- DNS ASK tr###.#eentracking.xyz
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%TEMP%\nseea9.tmp\ff\bin\certutil.exe' -A -n "AddedByUser ca.cert" -i "%TEMP%\nseEA9.tmp\FF\cacert\ca.cert.pem" -t "cTC,cTC,cTC", -d "%ProgramFiles(x86)%\Mozilla Firefox\browser\defaults\Profile"
- '%TEMP%\nseea9.tmp\ff\bin\certutil.exe' -A -n "AddedByUser ca.cert" -i "%TEMP%\nseEA9.tmp\FF\cacert\ca.cert.pem" -t "cTC,cTC,cTC", -d sql:"%ProgramFiles(x86)%\Mozilla Firefox\browser\defaults\Profile"
- '%TEMP%\nseea9.tmp\ff\bin\certutil.exe' -A -n "AddedByUser ca.cert" -i "%TEMP%\nseEA9.tmp\FF\cacert\ca.cert.pem" -t "cTC,cTC,cTC", -d "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default"
- '%TEMP%\nseea9.tmp\ff\bin\certutil.exe' -A -n "AddedByUser ca.cert" -i "%TEMP%\nseEA9.tmp\FF\cacert\ca.cert.pem" -t "cTC,cTC,cTC", -d sql:"%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default"
- '%TEMP%\nseea9.tmp\ff\bin\certutil.exe' -L -d "%ProgramFiles(x86)%\Mozilla Firefox\browser\defaults\Profile"
- '%TEMP%\nseea9.tmp\ff\bin\certutil.exe' -L -d sql:"%ProgramFiles(x86)%\Mozilla Firefox\browser\defaults\Profile"
- '%APPDATA%\topshape-b4\softwareupdate.exe' /run "/aff_id=1002" "/app_id=1"
- '%APPDATA%\topshape-b4\softwareupdate.exe' /uninstall
- '%APPDATA%\topshape-b4\softwareupdate.exe' /install
- '%WINDIR%\syswow64\sc.exe' stop TopShape' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop Software Updater' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nseEA9.tmp\FF\add-certs.cmd' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' failure "Software Updater Service" actions= restart/60000/restart/60000// reset= 86400' (with hidden window)
- '%APPDATA%\topshape-b4\softwareupdate.exe' /install' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop TopShape.me' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start "Software Updater Service"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' "/c start microsoft-edge:https://www.to##hape.me/thankyou.html"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nseEA9.tmp\FF\add-certs.cmd
- '%WINDIR%\syswow64\findstr.exe' /i "AddedByUser ca.cert"
- '%WINDIR%\syswow64\sc.exe' stop TopShape
- '%WINDIR%\syswow64\sc.exe' stop TopShape.me
- '%WINDIR%\syswow64\sc.exe' stop Software Updater
- '%WINDIR%\syswow64\sc.exe' failure "Software Updater Service" actions= restart/60000/restart/60000// reset= 86400
- '%WINDIR%\syswow64\sc.exe' start "Software Updater Service"
- '%WINDIR%\syswow64\cmd.exe' "/c start microsoft-edge:https://www.to##hape.me/thankyou.html"
