Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\CXFilter.ocx"
- '<SYSTEM32>\msiexec.exe' /Y "<SYSTEM32>\cmct3chs.dll"
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\mcsctrls.ocx"
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\queryrun.dll"
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\rqclient.dll"
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\spltrbar.ocx"
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\querywiz.dll"
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\cxbus.dll"
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\DataSync.dll"
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\cxpview.ocx"
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' /i pos.msi /passive
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\posinstall.bat" "
- '<SYSTEM32>\msiexec.exe' /x pos.msi /passive
- '<SYSTEM32>\msiexec.exe' -Embedding 56E9D4635EF50E24F3DC86FA7777A1E1
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\cxbp.dll"
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\vertmenu.ocx"
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\cxdgprn.dll"
- '<SYSTEM32>\msiexec.exe' /Y "%PROGRAM_FILES%\OMIS\key.dll"
Modifies file system :
Creates the following files:
- %WINDIR%\Installer\$PatchCache$\UnManaged\S-1-5-21-2052111302-484763869-725345543-1003\AAEF3AFE8B9C3DB41A04232C1C6666F0\6.0.0\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24
- %WINDIR%\Installer\$PatchCache$\UnManaged\S-1-5-21-2052111302-484763869-725345543-1003\AAEF3AFE8B9C3DB41A04232C1C6666F0\6.0.0\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
- %WINDIR%\Installer\$PatchCache$\UnManaged\S-1-5-21-2052111302-484763869-725345543-1003\AAEF3AFE8B9C3DB41A04232C1C6666F0\6.0.0\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
- %PROGRAM_FILES%\OMIS\cxpview.ocx
- %PROGRAM_FILES%\OMIS\DBConnect.exe
- <SYSTEM32>\mshfgchs.dll
- %PROGRAM_FILES%\OMIS\spltrbar.ocx
- %WINDIR%\Installer\$PatchCache$\UnManaged\S-1-5-21-2052111302-484763869-725345543-1003\AAEF3AFE8B9C3DB41A04232C1C6666F0\6.0.0\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
- %HOMEPATH%\Start Menu\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\КэѕЭївО¬»¤.lnk
- %ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\OMIS·ЦПъ№ЬАнПµНі\OMISКэѕЭ·ЦОц.lnk
- %ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\ИХЅбРЮёґ№¤ѕЯ.lnk
- %ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\КэѕЭївО¬»¤.lnk
- %WINDIR%\Installer\$PatchCache$\UnManaged\S-1-5-21-2052111302-484763869-725345543-1003\AAEF3AFE8B9C3DB41A04232C1C6666F0\6.0.0\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
- %WINDIR%\Installer\$PatchCache$\UnManaged\S-1-5-21-2052111302-484763869-725345543-1003\AAEF3AFE8B9C3DB41A04232C1C6666F0\6.0.0\Global_Vba_VbRuntime_f0.1E64E430_36E0_11D2_A794_0060089A724B
- %WINDIR%\Installer\$PatchCache$\UnManaged\S-1-5-21-2052111302-484763869-725345543-1003\AAEF3AFE8B9C3DB41A04232C1C6666F0\6.0.0\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24
- %PROGRAM_FILES%\OMIS\queryrun.dll
- %PROGRAM_FILES%\OMIS\SysUpdate.exe
- %PROGRAM_FILES%\OMIS\јмСйРЮёДИХЅб.exe
- %PROGRAM_FILES%\OMIS\StockCalc.exe
- %PROGRAM_FILES%\OMIS\BakRestore.exe
- <SYSTEM32>\datgdchs.dll
- <SYSTEM32>\cmct3chs.dll
- <SYSTEM32>\cmdlgchs.dll
- %PROGRAM_FILES%\OMIS\Compact.exe
- %PROGRAM_FILES%\OMIS\DTClient.exe
- %PROGRAM_FILES%\OMIS\DataSync.dll
- %PROGRAM_FILES%\OMIS\Cabarc.exe
- %PROGRAM_FILES%\OMIS\rqclient.dll
- %PROGRAM_FILES%\OMIS\QuerySys.exe
- %PROGRAM_FILES%\OMIS\cxdgprn.dll
- %PROGRAM_FILES%\OMIS\DtsHand.exe
- %HOMEPATH%\Desktop\OMISКэѕЭ·ЦОц.lnk
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_d4c3795.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_2c9a1121.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_7b39e95.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_a65270d.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_655b563a.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_77b9681b.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_44c56009.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_55835be3.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_742348ad.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_6183ed0.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_2de7705b.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_3e465043.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_5cb46e23.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_4f273956.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_2b86796d.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_7ba191c.exe
- %ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\Ф¶іМКэѕЭН¬ІЅ.lnk
- %HOMEPATH%\Start Menu\іМРт\OMIS·ЦПъ№ЬАнПµНі\OMISКэѕЭ·ЦОц.lnk
- %HOMEPATH%\Start Menu\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\Ф¶іМКэѕЭН¬ІЅ.lnk
- %ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\OMIS·ЦПъ№ЬАнПµНі\POSПµНі.lnk
- %HOMEPATH%\Desktop\POSПµНі.lnk
- %HOMEPATH%\Start Menu\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\ИХЅбРЮёґ№¤ѕЯ.lnk
- %HOMEPATH%\Start Menu\іМРт\OMIS·ЦПъ№ЬАнПµНі\POSПµНі.lnk
- %HOMEPATH%\Start Menu\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\КэѕЭ±ё·ЭєН»Цёґ.lnk
- %ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\КэѕЭївБ¬ЅУЙиЦГ.lnk
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_35f64970.exe
- %APPDATA%\Microsoft\Installer\{EFA3FEAA-C9B8-4BD3-A140-32C2C166660F}\_1421415f.exe
- %HOMEPATH%\Start Menu\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\КэѕЭївБ¬ЅУЙиЦГ.lnk
- %ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\КэѕЭ±ё·ЭєН»Цёґ.lnk
- %ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\ївґж¶ЁК±ЧФ¶ЇЦШЛг.lnk
- %HOMEPATH%\Start Menu\іМРт\OMIS·ЦПъ№ЬАнПµНі\ПµНі№¤ѕЯ\ївґж¶ЁК±ЧФ¶ЇЦШЛг.lnk
- %PROGRAM_FILES%\OMIS\omis.chm
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI2.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- %WINDIR%\Installer\MSI1.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\2f65d.msi
- %TEMP%\RarSFX0\posinstall.bat
- %TEMP%\RarSFX0\POS.msi
- %WINDIR%\Installer\2f65c.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %PROGRAM_FILES%\OMIS\cxbus.dll
- <SYSTEM32>\vb6chs.dll
- <SYSTEM32>\stdftchs.dll
- <SYSTEM32>\mscmcchs.dll
- %PROGRAM_FILES%\OMIS\hh.exe
- %PROGRAM_FILES%\OMIS\DBMaintain.exe
- %PROGRAM_FILES%\OMIS\logo.jpg
- %PROGRAM_FILES%\OMIS\vertmenu.ocx
- %PROGRAM_FILES%\OMIS\msado27.tlb
- %PROGRAM_FILES%\OMIS\OWC11.DLL
- %PROGRAM_FILES%\OMIS\CXFilter.ocx
- %PROGRAM_FILES%\OMIS\cxbp.dll
- %PROGRAM_FILES%\OMIS\querywiz.dll
- %PROGRAM_FILES%\OMIS\key.dll
- %PROGRAM_FILES%\OMIS\mcsctrls.ocx
- <SYSTEM32>\mscc2chs.dll
- <SYSTEM32>\mshflxgd.ocx
- <SYSTEM32>\msbind.dll
- <SYSTEM32>\msstdfmt.dll
- <SYSTEM32>\msdatgrd.ocx
- C:\Config.Msi\2f660.rbs
- <SYSTEM32>\mscomctl.ocx
- <SYSTEM32>\mscomct2.ocx
- <SYSTEM32>\mschrt20.ocx
- <SYSTEM32>\msdbrptr.dll
- <SYSTEM32>\comct332.ocx
- %PROGRAM_FILES%\OMIS\POS.exe
- <SYSTEM32>\msderun.dll
- <SYSTEM32>\mswinsck.ocx
- <SYSTEM32>\msinet.ocx
- <SYSTEM32>\comdlg32.ocx
Deletes the following files:
- C:\Config.Msi\2f660.rbs
- %WINDIR%\Installer\2f65d.msi
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\2f65c.msi
- %WINDIR%\Installer\MSI1.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'