Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\TA-PRS Agent Service] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\TA-PRS Agent Service] 'ImagePath' = '%ProgramFiles(x86)%\topaegis\PRS\wzNeordoSvc.exe'
- [<HKLM>\System\CurrentControlSet\Services\wzNetFilterX64] 'ImagePath' = '%ProgramFiles(x86)%\topaegis\PRS\wzNetFilterX64.sys'
Creates the following services
- 'TA-PRS Agent Service' %ProgramFiles(x86)%\topaegis\PRS\wzNeordoSvc.exe
- 'wzNetFilterX64' %ProgramFiles(x86)%\topaegis\PRS\wzNetFilterX64.sys
Changes the following executable system files
- %WINDIR%\syswow64\msvcp110.dll
- %WINDIR%\syswow64\msvcr110.dll
- %WINDIR%\syswow64\mfc110u.dll
Modifies file system
Creates the following files
- C:\bc8f992f5df34654945e6e32a5aa400c\ta-prs agent installer.exe
- %ProgramFiles(x86)%\topaegis\prs\wzupdater.exe
- %ProgramFiles(x86)%\topaegis\prs\wzsecurezip.dll
- %ProgramFiles(x86)%\topaegis\prs\wzpatchman.dll
- %ProgramFiles(x86)%\topaegis\prs\wznsi.dll
- %ProgramFiles(x86)%\topaegis\prs\wzneordosvc.exe
- %ProgramFiles(x86)%\topaegis\prs\wzlogger.dll
- %ProgramFiles(x86)%\topaegis\prs\wzcrypto.dll
- %ProgramFiles(x86)%\topaegis\prs\wzclientinfo.dll
- %ProgramFiles(x86)%\topaegis\prs\wzagentutil.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wztcptagger10x64.sys
- %ProgramFiles(x86)%\topaegis\prs\spdkeeper.exe
- %ProgramFiles(x86)%\topaegis\prs\spdagent.exe
- %ProgramFiles(x86)%\topaegis\prs\mfc110u.dll
- %ProgramFiles(x86)%\topaegis\prs\msvcr110.dll
- %ProgramFiles(x86)%\topaegis\prs\msvcp110.dll
- %ProgramFiles(x86)%\topaegis\prs\local-fs.crt
- %ProgramFiles(x86)%\topaegis\prs\server.cfg
- %ProgramFiles(x86)%\topaegis\prs\wznetfilterx64.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzupdater.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\wzwebquery.dll
- %ProgramFiles(x86)%\topaegis\prs\spdassistant.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\wztcptaggerx64.sys
- %ProgramFiles(x86)%\topaegis\prs\itst-ca.pem
- %ProgramFiles(x86)%\topaegis\prs\wzkeeperimage.dll
- %ProgramFiles(x86)%\topaegis\prs\logs\spdassitant-20210226.log
- %WINDIR%\temp\uddbb24.tmp
- %ProgramFiles(x86)%\topaegis\prs\logs\spdagent-20210226.log
- %ProgramFiles(x86)%\topaegis\prs\logs\wznerodosvc-20210226.log
- %ProgramFiles(x86)%\topaegis\prs\logs\wznerodosvc_start-20210226.log
- %ProgramFiles(x86)%\topaegis\prs\logs\wznerodosvc_install-20210226.log
- %ProgramFiles(x86)%\topaegis\prs\taprsuninstaller.exe
- %ProgramFiles(x86)%\topaegis\prs\tasecureclient.dll
- %ProgramFiles(x86)%\topaegis\prs\tasafepacket.dll
- %ProgramFiles(x86)%\topaegis\prs\wzcommon.dll
- %ProgramFiles(x86)%\topaegis\prs\itst-fs.crt
- %ProgramFiles(x86)%\topaegis\prs\wzkorea.dll
- %ProgramFiles(x86)%\topaegis\prs\wzenglish.dll
- %ProgramFiles(x86)%\topaegis\prs\wzpatchcom.dll
- %ProgramFiles(x86)%\topaegis\prs\wzwebquery.dll
- %ProgramFiles(x86)%\topaegis\prs\wzpckeeperui.dll
- %ProgramFiles(x86)%\topaegis\prs\wzpckeeper.dll
- %ProgramFiles(x86)%\topaegis\prs\wzpatcher.dll
- %ProgramFiles(x86)%\topaegis\prs\wznoticeview.exe
- %ProgramFiles(x86)%\topaegis\prs\wzipc.dll
- %ProgramFiles(x86)%\topaegis\prs\tagsutils.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wztcptagger10.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wztcptagger.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzsecurezip.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzclientinfo.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzagentutil.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\tasecureclient.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\tasafepacket.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\taprsuninstaller.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\tagsutils.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\spdkeeper.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\spdassistant.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\wzcommon.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\spdagent.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\msvcp110.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\mfc110u.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\certmgr.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\server.cfg
- C:\bc8f992f5df34654945e6e32a5aa400c\local-fs.crt
- C:\bc8f992f5df34654945e6e32a5aa400c\itst-fs.crt
- C:\bc8f992f5df34654945e6e32a5aa400c\itst-ca.pem
- C:\bc8f992f5df34654945e6e32a5aa400c\extractxzr.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\installarchive.zip
- C:\bc8f992f5df34654945e6e32a5aa400c\msvcr110.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzcrypto.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzcomdrv.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzenglish.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzprtprocxp.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzpatchcom.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzprtprocx64.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzprtproc.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzproccutxp.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzproccutx86.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzproccutx64.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzpckeeperui.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzpckeeper.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzpatchman.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzpatcher.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wznsi.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzipc.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wznoticeview.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\wznetfilter_vistax64.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wznetfilter_vista.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wznetfilterx64.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wznetfilter.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzneordosvc.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\wzlogger.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzkorea.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzkeeperimage.dll
- %ProgramFiles(x86)%\topaegis\prs\itst-fs.crt.tmp
- %ProgramFiles(x86)%\topaegis\prs\local-fs.crt.tmp
Deletes the following files
- %WINDIR%\temp\uddbb24.tmp
- C:\bc8f992f5df34654945e6e32a5aa400c\wznetfilter.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wznetfilterx64.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wznetfilter_vista.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wznetfilter_vistax64.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wznoticeview.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\wznsi.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzpatchcom.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzpatcher.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzpatchman.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzpckeeper.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\spdkeeper.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\wzpckeeperui.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzproccutx86.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzproccutxp.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzprtproc.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzprtprocx64.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzprtprocxp.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzsecurezip.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wztcptagger.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wztcptagger10.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wztcptagger10x64.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wztcptaggerx64.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\wzlogger.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzneordosvc.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\wzkorea.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzkeeperimage.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzipc.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\extractxzr.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\installarchive.zip
- C:\bc8f992f5df34654945e6e32a5aa400c\itst-ca.pem
- C:\bc8f992f5df34654945e6e32a5aa400c\itst-fs.crt
- C:\bc8f992f5df34654945e6e32a5aa400c\local-fs.crt
- C:\bc8f992f5df34654945e6e32a5aa400c\mfc110u.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\msvcp110.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\msvcr110.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\server.cfg
- C:\bc8f992f5df34654945e6e32a5aa400c\spdagent.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\wzupdater.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\wzproccutx64.sys
- C:\bc8f992f5df34654945e6e32a5aa400c\spdassistant.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\tagsutils.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\taprsuninstaller.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\tasafepacket.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\tasecureclient.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzagentutil.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzclientinfo.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzcomdrv.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzcommon.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzcrypto.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\wzenglish.dll
- C:\bc8f992f5df34654945e6e32a5aa400c\certmgr.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\ta-prs agent installer.exe
- C:\bc8f992f5df34654945e6e32a5aa400c\wzwebquery.dll
Moves the following files
- from %ProgramFiles(x86)%\topaegis\prs\itst-fs.crt.tmp to %ProgramFiles(x86)%\topaegis\prs\itst-fs.crt
- from %ProgramFiles(x86)%\topaegis\prs\local-fs.crt.tmp to %ProgramFiles(x86)%\topaegis\prs\local-fs.crt
Network activity
Connects to
- '21#.#02.136.253':443
- '21#.#02.136.253':80
TCP
- '21#.#02.136.253':443
Miscellaneous
Adds a root certificate
Creates and executes the following
- 'C:\bc8f992f5df34654945e6e32a5aa400c\ta-prs agent installer.exe'
- '%ProgramFiles(x86)%\topaegis\prs\wzneordosvc.exe'
- '%ProgramFiles(x86)%\topaegis\prs\wzneordosvc.exe' -start
- '%ProgramFiles(x86)%\topaegis\prs\wzneordosvc.exe' -install
- 'C:\bc8f992f5df34654945e6e32a5aa400c\wzupdater.exe' --uninstall
- '%ProgramFiles(x86)%\topaegis\prs\spdagent.exe'
- '%ProgramFiles(x86)%\topaegis\prs\spdassistant.exe'
- 'C:\bc8f992f5df34654945e6e32a5aa400c\extractxzr.exe' t C:\bc8f992f5df34654945e6e32a5aa400c\InstallArchive.zip
- 'C:\bc8f992f5df34654945e6e32a5aa400c\extractxzr.exe' x InstallArchive.zip -y -oC:\bc8f992f5df34654945e6e32a5aa400c
- 'C:\bc8f992f5df34654945e6e32a5aa400c\certmgr.exe' -add itst-ca.pem -c -s -r LocalMachine Root
- 'C:\bc8f992f5df34654945e6e32a5aa400c\certmgr.exe' -add itst-ca.pem -c -s -r LocalMachine Root' (with hidden window)
- 'C:\bc8f992f5df34654945e6e32a5aa400c\ta-prs agent installer.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe stop wzNetFilterX64' (with hidden window)
- '%ProgramFiles(x86)%\topaegis\prs\wzneordosvc.exe' -install' (with hidden window)
- 'C:\bc8f992f5df34654945e6e32a5aa400c\extractxzr.exe' t C:\bc8f992f5df34654945e6e32a5aa400c\InstallArchive.zip' (with hidden window)
- 'C:\bc8f992f5df34654945e6e32a5aa400c\wzupdater.exe' --uninstall' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe stop wzProcCutx64' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe delete wzTcpTaggerX64' (with hidden window)
- 'C:\bc8f992f5df34654945e6e32a5aa400c\extractxzr.exe' x InstallArchive.zip -y -oC:\bc8f992f5df34654945e6e32a5aa400c' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe delete wzProcCutx64' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe delete wzNetFilterX64' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe delete wzPrtProcX64' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe stop wzPrtProcX64' (with hidden window)
- '%ProgramFiles(x86)%\topaegis\prs\wzneordosvc.exe' -start' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe stop wzTcpTaggerX64' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe stop wzPrtProcX64
- '%WINDIR%\syswow64\sc.exe' stop wzPrtProcX64
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe delete wzPrtProcX64
- '%WINDIR%\syswow64\sc.exe' delete wzPrtProcX64
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe stop wzProcCutx64
- '%WINDIR%\syswow64\sc.exe' stop wzProcCutx64
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe delete wzProcCutx64
- '%WINDIR%\syswow64\sc.exe' delete wzProcCutx64
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe stop wzTcpTaggerX64
- '%WINDIR%\syswow64\sc.exe' stop wzTcpTaggerX64
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe delete wzTcpTaggerX64
- '%WINDIR%\syswow64\sc.exe' delete wzTcpTaggerX64
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe stop wzNetFilterX64
- '%WINDIR%\syswow64\sc.exe' stop wzNetFilterX64
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe delete wzNetFilterX64
- '%WINDIR%\syswow64\sc.exe' delete wzNetFilterX64
