Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Classes\apowersoft-launcher\shell\open\command] '' = '"%LOCALAPPDATA%\Apowersoft\Apowersoft Online Launcher\Apowersoft Online Launcher.exe" "%1"'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im "Apowersoft Online Launcher.exe"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Apowersoft Online Launcher" dir=in action=allow program="%LOCALAPPDATA%\Apowersoft\Apowersoft Online Launcher\Apowersoft Online Launcher.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Apowersoft Online Launcher" dir=out action=allow program="%LOCALAPPDATA%\Apowersoft\Apowersoft Online Launcher\Apowersoft Online Launcher.exe" enable=yes
Modifies file system
Creates the following files
- %TEMP%\is-hno5i.tmp\<File name>.tmp
- %TEMP%\tmpae2c.tmp
- %TEMP%\tmpae1b.tmp
- %APPDATA%\microsoft\systemcertificates\my\certificates\1fb86b1168ec743154062e8c9cc5b171a4b7ccb4
- %TEMP%\tmpa9e6.tmp
- %TEMP%\tmpa8eb.tmp
- %APPDATA%\apowersoft\apowersoft online launcher\log\apowersoft.onlinelauncher.log
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\382a29295437da48246936003e6693a0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %LOCALAPPDATA%\apowersoft\apowersoft online launcher\unins000.dat
- %LOCALAPPDATA%\apowersoft\apowersoft online launcher\is-tiqu0.tmp
- %LOCALAPPDATA%\apowersoft\apowersoft online launcher\is-or8l4.tmp
- %LOCALAPPDATA%\apowersoft\apowersoft online launcher\is-kvi7j.tmp
- %TEMP%\is-fk9ln.tmp\isxdl.dll
- %TEMP%\is-fk9ln.tmp\_isetup\_setup64.tmp
- %TEMP%\setup log 2021-06-18 #001.txt
- %LOCALAPPDATA%\apowersoft\apowersoft online launcher\is-7n94n.tmp
- %APPDATA%\apowersoft\apowersoft online launcher\apowersoft.update.ini
Deletes the following files
- %TEMP%\tmpa8eb.tmp
- %TEMP%\tmpa9e6.tmp
- %TEMP%\tmpae1b.tmp
- %TEMP%\tmpae2c.tmp
Moves the following files
- from %LOCALAPPDATA%\apowersoft\apowersoft online launcher\is-kvi7j.tmp to %LOCALAPPDATA%\apowersoft\apowersoft online launcher\unins000.exe
- from %LOCALAPPDATA%\apowersoft\apowersoft online launcher\is-or8l4.tmp to %LOCALAPPDATA%\apowersoft\apowersoft online launcher\apowersoft online launcher.exe
- from %LOCALAPPDATA%\apowersoft\apowersoft online launcher\is-tiqu0.tmp to %LOCALAPPDATA%\apowersoft\apowersoft online launcher\supersocket.socketengine.dll
- from %LOCALAPPDATA%\apowersoft\apowersoft online launcher\is-7n94n.tmp to %LOCALAPPDATA%\apowersoft\apowersoft online launcher\supersocket.websocket.dll
Network activity
Connects to
- 'su#####.apowersoft.com':443
TCP
Other
- 'su#####.apowersoft.com':443
UDP
- DNS ASK su#####.apowersoft.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-hno5i.tmp\<File name>.tmp' /SL5="$B021C,1163701,548864,<Full path to file>"
- '%LOCALAPPDATA%\apowersoft\apowersoft online launcher\apowersoft online launcher.exe'
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im "Apowersoft Online Launcher.exe"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="Apowersoft Online Launcher" program="%LOCALAPPDATA%\Apowersoft\Apowersoft Online Launcher\Apowersoft Online Launcher.exe"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Apowersoft Online Launcher" dir=in action=allow program="%LOCALAPPDATA%\Apowersoft\Apowersoft Online Launcher\Apowersoft Online Launcher.exe" enable=yes' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Apowersoft Online Launcher" dir=out action=allow program="%LOCALAPPDATA%\Apowersoft\Apowersoft Online Launcher\Apowersoft Online Launcher.exe" enable=yes' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="Apowersoft Online Launcher" program="%LOCALAPPDATA%\Apowersoft\Apowersoft Online Launcher\Apowersoft Online Launcher.exe"
