Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '127.0.0.1'
- DNS server to '<DNS_SERVER>'
Modifies file system
Creates the following files
- %TEMP%\aut3c92.tmp
- <Current directory>\launcherupdater.exe
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$i763076
Sets the 'hidden' attribute to the following files
- <Current directory>\launcherupdater.exe
Deletes the following files
- %TEMP%\aut3c92.tmp
- <DRIVERS>\etc\hosts
Network activity
TCP
- '<DNS_SERVER>':53
UDP
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '<Current directory>\launcherupdater.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /flushdns' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set address name="Ethernet" dhcp' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set dns name="Ethernet" static 127.0.0.1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip add dns name="Ethernet" 8.8.8.8 index=2' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set address name="Local Area Connection" dhcp' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set dns name="Local Area Connection" static 127.0.0.1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip add dns name="Local Area Connection" 8.8.8.8 index=2' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set address name="Local Area Connection 2" dhcp' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set dns name="Local Area Connection 2" static 127.0.0.1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip add dns name="Local Area Connection 2" 8.8.8.8 index=2' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set address name="Wired Ethernet Connection" dhcp' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set dns name="Wired Ethernet Connection" static 127.0.0.1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip add dns name="Wired Ethernet Connection" 8.8.8.8 index=2' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /flushdns
- '%WINDIR%\syswow64\netsh.exe' interface ip set dns name="Wired Ethernet Connection" static 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set dns name="Wired Ethernet Connection" static 127.0.0.1
- '%WINDIR%\syswow64\netsh.exe' interface ip set address name="Wired Ethernet Connection" dhcp
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set address name="Wired Ethernet Connection" dhcp
- '%WINDIR%\syswow64\netsh.exe' interface ip add dns name="Local Area Connection 2" 8.8.8.8 index=2
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip add dns name="Local Area Connection 2" 8.8.8.8 index=2
- '%WINDIR%\syswow64\netsh.exe' interface ip set dns name="Local Area Connection 2" static 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set dns name="Local Area Connection 2" static 127.0.0.1
- '%WINDIR%\syswow64\netsh.exe' interface ip set address name="Local Area Connection 2" dhcp
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set address name="Local Area Connection 2" dhcp
- '%WINDIR%\syswow64\netsh.exe' interface ip add dns name="Local Area Connection" 8.8.8.8 index=2
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip add dns name="Local Area Connection" 8.8.8.8 index=2
- '%WINDIR%\syswow64\netsh.exe' interface ip set dns name="Local Area Connection" static 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set dns name="Local Area Connection" static 127.0.0.1
- '%WINDIR%\syswow64\netsh.exe' interface ip set address name="Local Area Connection" dhcp
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set address name="Local Area Connection" dhcp
- '%WINDIR%\syswow64\netsh.exe' interface ip add dns name="Ethernet" 8.8.8.8 index=2
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip add dns name="Ethernet" 8.8.8.8 index=2
- '%WINDIR%\syswow64\netsh.exe' interface ip set dns name="Ethernet" static 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set dns name="Ethernet" static 127.0.0.1
- '%WINDIR%\syswow64\netsh.exe' interface ip set address name="Ethernet" dhcp
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip set address name="Ethernet" dhcp
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
- '%WINDIR%\syswow64\cmd.exe' /c netsh interface ip add dns name="Wired Ethernet Connection" 8.8.8.8 index=2
- '%WINDIR%\syswow64\netsh.exe' interface ip add dns name="Wired Ethernet Connection" 8.8.8.8 index=2
