Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;Add-MpPreference -ExclusionPath '%HO...
Injects code into
the following user processes:
- lucasakomodule.exe
Modifies file system
Creates the following files
- %TEMP%\nss2fa.tmp\system.dll
- %TEMP%\nss2fa.tmp\app-64.7z
- %TEMP%\nss2fa.tmp\nsis7z.dll
- %TEMP%\nss2fa.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nss2fa.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nss2fa.tmp\7z-out\icudtl.dat
- %TEMP%\nss2fa.tmp\7z-out\license.electron.txt
- %TEMP%\nss2fa.tmp\7z-out\licenses.chromium.html
- %TEMP%\nss2fa.tmp\7z-out\locales\af.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\am.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ar.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\bg.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\bn.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ca.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\cs.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\da.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\de.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\el.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\en-gb.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\en-us.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\es-419.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\es.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\et.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\fa.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\fi.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\fil.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\fr.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\gu.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\he.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\hi.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\hr.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\hu.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\id.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\it.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ja.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\kn.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ko.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\lt.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\lv.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ml.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\mr.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ms.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\nb.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\nl.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\pl.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\pt-br.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\pt-pt.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ro.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ru.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\sk.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\sl.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\sr.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\sv.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\sw.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ta.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\te.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\th.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\tr.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\uk.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ur.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\vi.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\zh-cn.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\zh-tw.pak
- %TEMP%\nss2fa.tmp\7z-out\resources\app.asar
- %TEMP%\nss2fa.tmp\7z-out\resources\de.pak
- %TEMP%\nss2fa.tmp\7z-out\resources.pak
- %TEMP%\nss2fa.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nss2fa.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nss2fa.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nss2fa.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nss2fa.tmp\7z-out\ffmpeg.dll
- %TEMP%\nss2fa.tmp\7z-out\libegl.dll
- %TEMP%\nss2fa.tmp\7z-out\libglesv2.dll
- %TEMP%\nss2fa.tmp\7z-out\lucasakomodule.exe
- %TEMP%\nss2fa.tmp\7z-out\resources\elevate.exe
- %TEMP%\nss2fa.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nss2fa.tmp\7z-out\vulkan-1.dll
- %TEMP%\r2c3msohhkc7yk2e\chrome_100_percent.pak
- %TEMP%\r2c3msohhkc7yk2e\chrome_200_percent.pak
- %TEMP%\r2c3msohhkc7yk2e\d3dcompiler_47.dll
- %TEMP%\r2c3msohhkc7yk2e\ffmpeg.dll
- %TEMP%\r2c3msohhkc7yk2e\icudtl.dat
- %TEMP%\r2c3msohhkc7yk2e\libegl.dll
- %TEMP%\r2c3msohhkc7yk2e\libglesv2.dll
- %TEMP%\r2c3msohhkc7yk2e\license.electron.txt
- %TEMP%\r2c3msohhkc7yk2e\licenses.chromium.html
- %TEMP%\r2c3msohhkc7yk2e\lucasakomodule.exe
- %TEMP%\r2c3msohhkc7yk2e\resources.pak
- %TEMP%\r2c3msohhkc7yk2e\snapshot_blob.bin
- %TEMP%\r2c3msohhkc7yk2e\v8_context_snapshot.bin
- %TEMP%\r2c3msohhkc7yk2e\vk_swiftshader.dll
- %TEMP%\r2c3msohhkc7yk2e\vk_swiftshader_icd.json
- %TEMP%\r2c3msohhkc7yk2e\vulkan-1.dll
- %TEMP%\r2c3msohhkc7yk2e\locales\af.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\am.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ar.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\bg.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\bn.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ca.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\cs.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\da.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\de.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\el.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\en-gb.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\en-us.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\es-419.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\es.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\et.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\fa.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\fi.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\fil.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\fr.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\gu.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\he.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\hi.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\hr.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\hu.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\id.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\it.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ja.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\kn.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ko.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\lt.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\lv.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ml.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\mr.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ms.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\nb.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\nl.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\pl.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\pt-br.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\pt-pt.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ro.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ru.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\sk.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\sl.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\sr.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\sv.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\sw.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ta.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\te.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\th.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\tr.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\uk.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ur.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\vi.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\zh-cn.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\zh-tw.pak
- %TEMP%\r2c3msohhkc7yk2e\resources\app.asar
- %TEMP%\r2c3msohhkc7yk2e\resources\de.pak
- %TEMP%\r2c3msohhkc7yk2e\resources\elevate.exe
- %TEMP%\nss2fa.tmp\stdutils.dll
- %HOMEPATH%\appdata\.vrw1iy8f\7ke8fr2o72.exe
- %APPDATA%\lucasakomodule-dym56c\9237b5ee-3565-4279-bab2-f5a1694c4a21.tmp
Deletes following files that it created itself
- %TEMP%\r2c3msohhkc7yk2e\chrome_100_percent.pak
- %TEMP%\r2c3msohhkc7yk2e\chrome_200_percent.pak
- %TEMP%\r2c3msohhkc7yk2e\d3dcompiler_47.dll
- %TEMP%\r2c3msohhkc7yk2e\ffmpeg.dll
- %TEMP%\r2c3msohhkc7yk2e\icudtl.dat
- %TEMP%\r2c3msohhkc7yk2e\libegl.dll
- %TEMP%\r2c3msohhkc7yk2e\libglesv2.dll
- %TEMP%\r2c3msohhkc7yk2e\license.electron.txt
- %TEMP%\r2c3msohhkc7yk2e\licenses.chromium.html
- %TEMP%\r2c3msohhkc7yk2e\locales\af.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\am.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ar.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\bg.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\bn.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ca.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\cs.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\da.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\de.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\el.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\en-gb.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\en-us.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\es-419.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\es.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\et.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\fa.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\fi.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\fil.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\fr.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\gu.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\he.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\hi.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\hr.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\hu.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\id.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\it.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ja.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\kn.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ko.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\lt.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\lv.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ml.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\mr.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ms.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\nb.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\nl.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\pl.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\pt-br.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\pt-pt.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ro.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ru.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\sk.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\sl.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\sr.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\sv.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\sw.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ta.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\te.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\th.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\tr.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\uk.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\ur.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\vi.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\zh-cn.pak
- %TEMP%\r2c3msohhkc7yk2e\locales\zh-tw.pak
- %TEMP%\r2c3msohhkc7yk2e\lucasakomodule.exe
- %TEMP%\r2c3msohhkc7yk2e\resources\app.asar
- %TEMP%\r2c3msohhkc7yk2e\resources\de.pak
- %TEMP%\r2c3msohhkc7yk2e\resources\elevate.exe
- %TEMP%\r2c3msohhkc7yk2e\resources.pak
- %TEMP%\r2c3msohhkc7yk2e\snapshot_blob.bin
- %TEMP%\r2c3msohhkc7yk2e\v8_context_snapshot.bin
- %TEMP%\r2c3msohhkc7yk2e\vk_swiftshader.dll
- %TEMP%\r2c3msohhkc7yk2e\vk_swiftshader_icd.json
- %TEMP%\r2c3msohhkc7yk2e\vulkan-1.dll
- %TEMP%\nss2fa.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nss2fa.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nss2fa.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nss2fa.tmp\7z-out\ffmpeg.dll
- %TEMP%\nss2fa.tmp\7z-out\icudtl.dat
- %TEMP%\nss2fa.tmp\7z-out\libegl.dll
- %TEMP%\nss2fa.tmp\7z-out\libglesv2.dll
- %TEMP%\nss2fa.tmp\7z-out\license.electron.txt
- %TEMP%\nss2fa.tmp\7z-out\licenses.chromium.html
- %TEMP%\nss2fa.tmp\7z-out\locales\af.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\am.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ar.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\bg.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\bn.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ca.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\cs.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\da.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\de.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\el.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\en-gb.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\en-us.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\es-419.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\es.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\et.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\fa.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\fi.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\fil.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\fr.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\gu.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\he.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\hi.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\hr.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\hu.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\id.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\it.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ja.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\kn.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ko.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\lt.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\lv.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ml.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\mr.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ms.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\nb.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\nl.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\pl.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\pt-br.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\pt-pt.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ro.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ru.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\sk.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\sl.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\sr.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\sv.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\sw.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ta.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\te.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\th.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\tr.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\uk.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\ur.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\vi.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\zh-cn.pak
- %TEMP%\nss2fa.tmp\7z-out\locales\zh-tw.pak
- %TEMP%\nss2fa.tmp\7z-out\lucasakomodule.exe
- %TEMP%\nss2fa.tmp\7z-out\resources\app.asar
- %TEMP%\nss2fa.tmp\7z-out\resources\de.pak
- %TEMP%\nss2fa.tmp\7z-out\resources\elevate.exe
- %TEMP%\nss2fa.tmp\7z-out\resources.pak
- %TEMP%\nss2fa.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nss2fa.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nss2fa.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nss2fa.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nss2fa.tmp\7z-out\vulkan-1.dll
- %TEMP%\nss2fa.tmp\app-64.7z
- %TEMP%\nss2fa.tmp\nsis7z.dll
- %TEMP%\nss2fa.tmp\stdutils.dll
- %TEMP%\nss2fa.tmp\system.dll
Moves the following files
- from %APPDATA%\lucasakomodule-dym56c\9237b5ee-3565-4279-bab2-f5a1694c4a21.tmp to %APPDATA%\lucasakomodule-dym56c\local state
Network activity
Connects to
- 'de####.#entor-garden.click':443
- 'po######public.nodies.app':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67##############
Other
- 'de####.#entor-garden.click':443
- 'po######public.nodies.app':443
UDP
- DNS ASK de####.#entor-garden.click
- DNS ASK po######public.nodies.app
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\lucasakomodule-dym56c'
Creates and executes the following
- '%TEMP%\r2c3msohhkc7yk2e\lucasakomodule.exe'
- '%TEMP%\r2c3msohhkc7yk2e\lucasakomodule.exe' --type=gpu-process --user-data-dir="%APPDATA%\lucasakomodule-dym56c" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAA...
- '%HOMEPATH%\appdata\.vrw1iy8f\7ke8fr2o72.exe'
- '%TEMP%\r2c3msohhkc7yk2e\lucasakomodule.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\lucasakomodule-dym56c" --field-trial-handle=2124,i,16457748776...
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name /format:list"
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name /format:list
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;$target = '%HOMEPATH%\AppData'; try ...
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name /format:list"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;$target = '%HOMEPATH%\AppData'; try ...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;Add-MpPreference -ExclusionPath '%HO...' (with hidden window)
- '%HOMEPATH%\appdata\.vrw1iy8f\7ke8fr2o72.exe' ' (with hidden window)