Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\certutil.exe' -addstore -f root LenovoRootCA.cer
- '%TEMP%\nsd3.tmp\ns4.tmp' %TEMP%\AnyConnect\setup.cmd
Executes the following:
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 038EDB293133855EB13CCEB6BA86D9C9
- '<SYSTEM32>\cscript.exe' /b shortcut.vbs
- '<SYSTEM32>\cmd.exe' /c %TEMP%\AnyConnect\setup.cmd
- '<SYSTEM32>\find.exe' /i "5."
- '<SYSTEM32>\msiexec.exe' /i Cisco\anyconnect-win-3.1.06073-pre-deploy-k9.msi /passive /promptrestart
Modifies file system :
Creates the following files:
- %TEMP%\AnyConnect\Cisco\res\cues_bg.jpg
- %TEMP%\AnyConnect\Cisco\res\error.ico
- %TEMP%\AnyConnect\Cisco\res\gradient.png
- %TEMP%\AnyConnect\Cisco\res\company_logo_alt.png
- %TEMP%\AnyConnect\Cisco\res\app_logo.png
- %TEMP%\AnyConnect\Cisco\res\attention.ico
- %TEMP%\AnyConnect\Cisco\res\company_logo.png
- %TEMP%\AnyConnect\Cisco\res\status_ico_attention.png
- %TEMP%\AnyConnect\Cisco\res\status_ico_error.png
- %TEMP%\AnyConnect\Cisco\res\status_ico_good.png
- %TEMP%\AnyConnect\Cisco\res\neutral.ico
- %TEMP%\AnyConnect\Cisco\res\mftogglebtn-down-solid.png
- %TEMP%\AnyConnect\Cisco\res\mftogglebtn-down.png
- %TEMP%\AnyConnect\Cisco\res\mftogglebtn.png
- %TEMP%\AnyConnect\Cisco\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\VPNDisable_ServiceProfile.xml
- %TEMP%\AnyConnect\Cisco\CommonAppDataFolder\Microsoft\Event Viewer\Views\Cisco\CiscoAnyConnect.xml
- %TEMP%\AnyConnect\Cisco\Plugins\acfeedback.dll
- %TEMP%\AnyConnect\Cisco\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\AnyConnectProfile.xsd
- %TEMP%\AnyConnect\Cisco\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\VPNManifestClient.xml
- %TEMP%\AnyConnect\Cisco\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\eula.txt
- %TEMP%\AnyConnect\Cisco\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\update.txt
- %TEMP%\AnyConnect\Cisco\res\GUI.ico
- %TEMP%\AnyConnect\Cisco\res\about.png
- %TEMP%\AnyConnect\Cisco\res\about_hover.png
- %TEMP%\AnyConnect\Cisco\SystemFolder\vpnevents.dll
- %TEMP%\AnyConnect\Cisco\Plugins\actoast.dll
- %TEMP%\AnyConnect\Cisco\Plugins\vpnipsec.dll
- %TEMP%\AnyConnect\Cisco\SystemFolder\vpncategories.dll
- %TEMP%\AnyConnect\Cisco\res\status_ico_neutral.png
- <SYSTEM32>\certadm.dll
- <SYSTEM32>\certutil.exe
- %TEMP%\nsd3.tmp\ns4.tmp
- %TEMP%\AnyConnect\Cisco\res\vpn_connected.ico
- %TEMP%\AnyConnect\Cisco\res\vpn_logo.png
- %TEMP%\nsd3.tmp\nsExec.dll
- %TEMP%\MSI32665.LOG
- %ALLUSERSPROFILE%\Application Data\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\lenovoprofile.xml
- %TEMP%\AnyConnect\shortcut.vbs
- %WINDIR%\Installer\MSI5.tmp
- %TEMP%\AnyConnect\LenovoRootCA.cer
- %WINDIR%\certutil.log
- %WINDIR%\Installer\31ec4.msi
- %TEMP%\AnyConnect\Cisco\res\toolbar.png
- %TEMP%\AnyConnect\Cisco\res\toolbar_about.png
- %TEMP%\AnyConnect\Cisco\res\toolbar_about_hover.png
- %TEMP%\AnyConnect\Cisco\res\toast_vpn.png
- %TEMP%\AnyConnect\Cisco\res\status_ico_transition.png
- %TEMP%\AnyConnect\Cisco\res\status_ico_trusted.png
- %TEMP%\AnyConnect\Cisco\res\toast_nam.png
- %TEMP%\AnyConnect\Cisco\res\transition_1.ico
- %TEMP%\AnyConnect\Cisco\res\transition_2.ico
- %TEMP%\AnyConnect\Cisco\res\transition_3.ico
- %TEMP%\AnyConnect\Cisco\res\toolbar_prefs_hover.png
- %TEMP%\AnyConnect\Cisco\res\toolbar_help.png
- %TEMP%\AnyConnect\Cisco\res\toolbar_help_hover.png
- %TEMP%\AnyConnect\Cisco\res\toolbar_prefs.png
- %TEMP%\AnyConnect\Cisco\acsint64.cat
- %TEMP%\AnyConnect\Cisco\acsint64.inf
- %TEMP%\AnyConnect\Cisco\acsint64.sys
- %TEMP%\AnyConnect\Cisco\acsint.sys
- %TEMP%\AnyConnect\Cisco\acciscossl.dll
- %TEMP%\AnyConnect\Cisco\acsint.cat
- %TEMP%\AnyConnect\Cisco\acsint.inf
- %TEMP%\AnyConnect\Cisco\acsmux64.inf
- %TEMP%\AnyConnect\Cisco\acsmux64.sys
- %TEMP%\AnyConnect\Cisco\acsock.cat
- %TEMP%\AnyConnect\Cisco\acsmux64.cat
- %TEMP%\AnyConnect\Cisco\acsmux.cat
- %TEMP%\AnyConnect\Cisco\acsmux.inf
- %TEMP%\AnyConnect\Cisco\acsmux.sys
- %TEMP%\AnyConnect\CertUtil\certutil.exe
- %TEMP%\AnyConnect\Cisco\InstallHelper.exe
- %TEMP%\AnyConnect\Cisco\InstallHelper64.exe
- %TEMP%\AnyConnect\CertUtil\certadm.dll
- %TEMP%\nsa2.tmp
- %TEMP%\AnyConnect\lenovoprofile.xml
- %TEMP%\AnyConnect\setup.cmd
- %TEMP%\AnyConnect\Cisco\VACon64.exe
- %TEMP%\AnyConnect\Cisco\ac_sock_fltr_api.dll
- %TEMP%\AnyConnect\Cisco\acciscocrypto.dll
- %TEMP%\AnyConnect\Cisco\VACon.exe
- %TEMP%\AnyConnect\Cisco\ManifestTool.exe
- %TEMP%\AnyConnect\Cisco\OpenSource.html
- %TEMP%\AnyConnect\Cisco\Uninstall.exe
- %TEMP%\AnyConnect\Cisco\acsock.inf
- %TEMP%\AnyConnect\Cisco\vpnva.inf
- %TEMP%\AnyConnect\Cisco\vpnva.sys
- %TEMP%\AnyConnect\Cisco\vpnva64-6.sys
- %TEMP%\AnyConnect\Cisco\vpnva.cat
- %TEMP%\AnyConnect\Cisco\vpnva-6.cat
- %TEMP%\AnyConnect\Cisco\vpnva-6.inf
- %TEMP%\AnyConnect\Cisco\vpnva-6.sys
- %TEMP%\AnyConnect\Cisco\vpnweb64.ocx
- %TEMP%\AnyConnect\Cisco\zlib1.dll
- %TEMP%\AnyConnect\Cisco\CommonAppDataFolder\Cisco\Cisco AnyConnect Secure Mobility Client\AnyConnectLocalPolicy.xsd
- %TEMP%\AnyConnect\Cisco\vpnweb.ocx
- %TEMP%\AnyConnect\Cisco\vpnva64.cat
- %TEMP%\AnyConnect\Cisco\vpnva64.inf
- %TEMP%\AnyConnect\Cisco\vpnva64.sys
- %TEMP%\AnyConnect\Cisco\acsock64.sys
- %TEMP%\AnyConnect\Cisco\anyconnect-win-3.1.06073-pre-deploy-k9.msi
- %TEMP%\AnyConnect\Cisco\vpnagent.exe
- %TEMP%\AnyConnect\Cisco\acsock64.inf
- %TEMP%\AnyConnect\Cisco\acsock.sys
- %TEMP%\AnyConnect\Cisco\acsock.xml
- %TEMP%\AnyConnect\Cisco\acsock64.cat
- %TEMP%\AnyConnect\Cisco\vpncommoncrypt.dll
- %TEMP%\AnyConnect\Cisco\vpndownloader.exe
- %TEMP%\AnyConnect\Cisco\vpnui.exe
- %TEMP%\AnyConnect\Cisco\vpncommon.dll
- %TEMP%\AnyConnect\Cisco\vpnagentutilities.dll
- %TEMP%\AnyConnect\Cisco\vpnapi.dll
- %TEMP%\AnyConnect\Cisco\vpncli.exe
Deletes the following files:
- %TEMP%\AnyConnect\shortcut.vbs
- %WINDIR%\Installer\31ec4.msi
- %WINDIR%\Installer\MSI5.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
Adds a root certificate