Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\dgbusmon] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\dgtdimon] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\DGService] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\DGMASTER] 'Start' = '00000000'
Substitutes the following executable system files:
- <SYSTEM32>\msvcp71.dll with <SYSTEM32>\msvcp71.dll
- <SYSTEM32>\msvcr71.dll with <SYSTEM32>\msvcr71.dll
Infects the following executable files:
- <SYSTEM32>\msvcp71.dll
- <SYSTEM32>\msvcr71.dll
Malicious functions:
Creates and executes the following:
- '%TEMP%\mia2.tmp\DGAgentSetup.exe' /s LOGFILE="%WINDIR%\DGAgentSilentInstall.log" UNINSTALLKEY="Verdasys1" /m="%TEMP%\532_0194\SEC01\DGBASE~1.EXE" /k=""
- '%TEMP%\532_0194\SEC01\DGBaseAgent.exe' /s LOGFILE="%WINDIR%\DGAgentSilentInstall.log" UNINSTALLKEY="Verdasys1"
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding 3396F45181D463FEDC181B242C52894E
- '<SYSTEM32>\msiexec.exe' -Embedding AD2EBB29A1296E46F3124DC1D0C086A7
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\mia1\msxml.msi" /qn /l*v %WINDIR%\MSXML4SP3Install.log
- '<SYSTEM32>\msiexec.exe' /V
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtQuerySystemInformation, handler: dgapimon.sys
- NtQueryValueKey, handler: dgapimon.sys
- NtOpenSection, handler: dgapimon.sys
- NtQueryKey, handler: dgapimon.sys
- NtSetInformationKey, handler: dgapimon.sys
- NtSetValueKey, handler: dgapimon.sys
- NtRenameKey, handler: dgapimon.sys
- NtSetInformationFile, handler: dgapimon.sys
- NtCreateSection, handler: dgapimon.sys
- NtDeleteKey, handler: dgapimon.sys
- NtClose, handler: dgapimon.sys
- NtCreateKey, handler: dgapimon.sys
- NtOpenKey, handler: dgapimon.sys
- NtOpenProcess, handler: dgapimon.sys
- NtDeleteValueKey, handler: dgapimon.sys
- NtEnumerateKey, handler: dgapimon.sys
Hides the following processes:
- %TEMP%\532_0194\SEC01\DGBaseAgent.exe
Modifies file system :
Creates the following files:
- %TEMP%\mia1\mWinRunExec.dll
- %TEMP%\mia1\SetupHelper-IA.dll
- %TEMP%\mia1\msvcr71.dll
- %TEMP%\mia1\msvcp71.dll
- %TEMP%\mia1\msvcr70.dll
- %WINDIR%\MSXML4SP3Install.log
- %WINDIR%\Installer\3d022.msi
- %WINDIR%\DGAgentSilentInstall.log
- %TEMP%\mia1\unzip.exe
- %TEMP%\mia1\DGAgentSetup.msi
- %TEMP%\mia1\mEXEFunc.dll
- %TEMP%\mia1\startmenu.dfm
- %TEMP%\mia1\translations.English
- %TEMP%\mia1\startinstallation.dfm
- %TEMP%\mia1\shared.translations.Map
- %TEMP%\mia1\shared.translations.Original
- %TEMP%\mia1\welcome.dfm
- %TEMP%\mia1\wizard.dfm
- %TEMP%\mia1\translations.Original
- %TEMP%\mia1\translations.Japanese
- %TEMP%\mia1\translations.Map
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- %TEMP%\{917BAAEA-297A-4B35-ACDD-A26C47D64DF6}
- %WINDIR%\Installer\3d027.msi
- %TEMP%\flags.xml
- %WINDIR%\WinSxS\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.30.2100.0_x-ww_30941067.cat
- %WINDIR%\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.30.2100.0_x-ww_30941067\msxml4r.dll
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\WinSxS\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.30.2100.0_x-ww_30941067.manifest
- C:\Config.Msi\3d025.rbs
- %PROGRAM_FILES%\MSXML 4.0\xmleula.rtf
- %WINDIR%\Installer\MSI4.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\WinSxS\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.30.2100.0_x-ww_b9ea3bd7.cat
- %WINDIR%\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.30.2100.0_x-ww_b9ea3bd7\msxml4.dll
- %WINDIR%\WinSxS\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.30.2100.0_x-ww_b9ea3bd7.manifest
- <SYSTEM32>\msxml4.dll
- <SYSTEM32>\msxml4r.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.inf
- %TEMP%\mia2.tmp\data\OFFLINE\3091B632\2C5B4284\netsf.inf
- %TEMP%\mia2.tmp\data\OFFLINE\40073790\A2E42D80\idolHeader.idx
- %TEMP%\mia2.tmp\data\OFFLINE\EFF98D6\A2E42D80\edk_dict.dtd
- %TEMP%\mia2.tmp\data\OFFLINE\6EE46463\A2E42D80\edk_gram.dtd
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimain.sdb
- %TEMP%\lang.loc
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimain.sdb
- %TEMP%\mia2.tmp\data\OFFLINE\3091B632\2C5B4284\netsf_m.inf
- %TEMP%\mia2.tmp\DGAgentSetup.res
- %TEMP%\mia2.tmp\data\OFFLINE\CECC170F\A2E42D80\edk_config.dtd
- %TEMP%\mia2.tmp\mia.lib
- %TEMP%\mia2.tmp\data\OFFLINE\C9C89777\2C5B4284\dgcot.cat
- %TEMP%\mia2.tmp\data\OFFLINE\5E91FEF\E0ACC3F3\DGWFP.sys
- %TEMP%\mia2.tmp\data\OFFLINE\1654A937\EDBFA323\DGTDIMon.sys
- %TEMP%\mia2.tmp\data\OFFLINE\2C309E0E\4D80942E\DGWFP.sys
- %TEMP%\mia2.tmp\data\OFFLINE\7F353A7D\A2E42D80\prcsflgs.dat
- %TEMP%\mia2.tmp\data\OFFLINE\37DE4E4A\1FDC7102\root.dat
- %TEMP%\mia2.tmp\data\OFFLINE\C6361138\1FDC7102\dirctrl.dat
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.cat
- %TEMP%\mia2.tmp\data\OFFLINE\728DFBD0\1FDC7102\dirctrl.dat
- %TEMP%\mia.tmp
- %TEMP%\mia1\progressprereq.dfm
- %TEMP%\mia1\readme.dfm
- %TEMP%\mia1\progress.dfm
- %TEMP%\mia1\msxml.msi
- %TEMP%\mia1\prereq.dfm
- %TEMP%\mia1\shared.translations.english
- %TEMP%\mia1\shared.translations.japanese
- %TEMP%\mia1\setuptype.dfm
- %TEMP%\mia1\registration.dfm
- %TEMP%\mia1\serverconnect.dfm
- %TEMP%\mia1\manifest64.xml
- %TEMP%\mia1\destination.dfm
- %TEMP%\mia1\Digital Guardian Agent.mtx
- %TEMP%\mia1\componentstree.dfm
- %TEMP%\mia1\AgentParams.ini
- %TEMP%\mia1\cancel.dfm
- %TEMP%\mia1\maintenance.dfm
- %TEMP%\mia1\manifest32.xml
- %TEMP%\mia1\licensecheck.dfm
- %TEMP%\mia1\finish.dfm
- %TEMP%\mia1\license.rtf
- <DRIVERS>\DGKPMail.sys
- C:\Programmi\DGAgent\plugins\3E8BD758-B307-4cf3-920D-E720676FF1F3\COT_Agent_PlugIn.dll
- C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\XceedZip.dll
- C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\AME_OutlookSensor.dll
- C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\AME_SmtpSensor.dll
- C:\Programmi\DGAgent\plugins\3E8BD758-B307-4cf3-920D-E720676FF1F3\netsf.inf
- C:\Programmi\DGAgent\plugins\3E8BD758-B307-4cf3-920D-E720676FF1F3\netsf_m.inf
- C:\Programmi\DGAgent\plugins\3E8BD758-B307-4cf3-920D-E720676FF1F3\dgcot.cat
- C:\Programmi\DGAgent\plugins\3E8BD758-B307-4cf3-920D-E720676FF1F3\COT_Test_App.exe
- <DRIVERS>\DGCotMan.sys
- C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\AME_NotesSensor.dll
- <DRIVERS>\dgdmk.sys
- <DRIVERS>\DgDmkDisk.sys
- <SYSTEM32>\DGShlExt.dll
- C:\Programmi\DGAgent\winver_xp_x86.reg
- C:\Programmi\DGAgent\plugins\8B13081C-AF44-458e-80E9-642D6A755D77\AFE_Agent_Plugin.dll
- C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\AE_MailSensor_Plugin.dll
- C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\AE_Agent_Plugin.dll
- <DRIVERS>\dglfs.sys
- <DRIVERS>\dgdt.sys
- <DRIVERS>\dgfs.sys
- C:\Programmi\DGAgent\plugins\F0E6A8B9-0A13-4720-94D7-45663C8B9011\DGDctm.dll
- %ALLUSERSPROFILE%\Application Data\{448261FB-4AC6-4773-A89E-0D61C251A88D}\instance.dat
- C:\Programmi\DGAgent\config.xml
- %ALLUSERSPROFILE%\Application Data\{448261FB-4AC6-4773-A89E-0D61C251A88D}\DGAgentSetup.lan
- %ALLUSERSPROFILE%\Application Data\{448261FB-4AC6-4773-A89E-0D61C251A88D}\DGAgentSetup.dat
- %ALLUSERSPROFILE%\Application Data\{448261FB-4AC6-4773-A89E-0D61C251A88D}\DGAgentSetup.par
- C:\Programmi\DGAgent\{5EAFABB7-68DE-16FD-FEA9-F2D06B3C8033}.cer
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\1635468cecbd5d6c55a5d992847bd833_23ef5514-3059-436f-a4a7-4cefaab20eb1
- C:\Programmi\DGAgent\CERTGUID.DAT
- C:\Programmi\DGAgent\REG_SYS.SAV
- C:\Programmi\DGAgent\DGSERVER.CER
- %ALLUSERSPROFILE%\Application Data\{448261FB-4AC6-4773-A89E-0D61C251A88D}\mia.lib
- C:\Programmi\DGAgent\DgRemediation.dll
- C:\Programmi\DGAgent\DgRemed_WebPerformanceA.dll
- C:\Programmi\DGAgent\Stingray.dll
- C:\Programmi\DGAgent\DgScan.exe
- C:\Programmi\DGAgent\MFC71u.dll
- %ALLUSERSPROFILE%\Application Data\{448261FB-4AC6-4773-A89E-0D61C251A88D}\DGAgentSetup.msi
- %ALLUSERSPROFILE%\Application Data\{448261FB-4AC6-4773-A89E-0D61C251A88D}\DGAgentSetup.res
- %ALLUSERSPROFILE%\Application Data\{448261FB-4AC6-4773-A89E-0D61C251A88D}\DGAgentSetup.exe
- C:\Programmi\DGAgent\DgRemedAgentHelper.dll
- C:\Programmi\DGAgent\DG-Diag.exe
- C:\Programmi\DGAgent\clipart\block.bmp
- C:\Programmi\DGAgent\clipart\Block.txt
- C:\Programmi\DGAgent\DgUpdate.exe
- C:\Programmi\DGAgent\dirctrl.dat
- C:\Programmi\DGAgent\DgPrompt.exe
- C:\Programmi\DGAgent\DgClient.dll
- C:\Programmi\DGAgent\DGCIVrfy.dll
- <SYSTEM32>\DgApi.dll
- C:\Programmi\DGAgent\impflt.bin
- C:\Programmi\DGAgent\DGImager.dll
- C:\Programmi\DGAgent\root.dat
- C:\Programmi\DGAgent\Misc\DgCleaner.exe
- C:\Programmi\DGAgent\DgAgent.exe
- C:\Programmi\DGAgent\msvcp71.dll
- C:\Config.Msi\3d02a.rbs
- C:\Programmi\DGAgent\msvcr71.dll
- C:\Programmi\DGAgent\flags.xml
- C:\Programmi\DGAgent\prcsflgs.dat
- C:\Programmi\DGAgent\manifest.xml
- C:\Programmi\DGAgent\BaseAgentConfig.xml
- C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\ameCfg.xml
- C:\Programmi\DGAgent\DGClassify.dll
- C:\Programmi\DGAgent\DgService.exe
- C:\Programmi\DGAgent\DGCI2.dll
- <DRIVERS>\DGTDIMon.sys
- <DRIVERS>\DGBUSMon.sys
- <DRIVERS>\dgfsmon.sys
- C:\Programmi\DGAgent\plugins\8e4ea70a-6128-4b57-bd3f-8e9e0f0da6bb\OS_Plugin.dll
- C:\Programmi\DGAgent\plugins\8e4ea70a-6128-4b57-bd3f-8e9e0f0da6bb\COM_Sensor.dll
- C:\Programmi\DGAgent\dg_gdiplus.dll
- C:\Programmi\DGAgent\DGCI_ATTIVIO.DLL
- C:\Programmi\DGAgent\idolHeader.idx
- <DRIVERS>\DGAPIMon.sys
- C:\Programmi\DGAgent\edk_gram.dtd
- C:\Programmi\DGAgent\highgroup.txt
- C:\Programmi\DGAgent\edk_dict.dtd
- C:\Programmi\DGAgent\DgRuleMeta.xml
- C:\Programmi\DGAgent\edk_config.dtd
- <DRIVERS>\DGMaster.sys
- <DRIVERS>\DGRule.sys
- C:\Programmi\DGAgent\DGCipher.exe
- C:\Programmi\DGAgent\XceedZip.dll
- C:\Programmi\DGAgent\SubclassExclusionList.ini
- %TEMP%\mia2.tmp\data\OFFLINE\A03F349E\445B24B1\DGTDIMon.sys
- %TEMP%\mia2.tmp\data\OFFLINE\312276C4\445B24B1\AFE_Agent_Plugin.dll
- %TEMP%\mia2.tmp\data\OFFLINE\5AA2871C\EDBFA323\AFE_Agent_Plugin.dll
- %TEMP%\mia2.tmp\data\OFFLINE\99B7A42A\EDBFA323\AE_MailSensor_Plugin64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\2457BE5A\EDBFA323\AE_Agent_Plugin64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\AE9888C\445B24B1\AE_MailSensor_Plugin.dll
- %TEMP%\mia2.tmp\data\OFFLINE\A928AED5\EDBFA323\AME_NotesSensor64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\B2B8204C\445B24B1\AME_OutlookSensor.dll
- %TEMP%\mia2.tmp\data\OFFLINE\DC97DE8A\445B24B1\AME_NotesSensor.dll
- %TEMP%\mia2.tmp\data\OFFLINE\9685C76C\445B24B1\AME_BESDominoSensor.dll
- %TEMP%\mia2.tmp\data\OFFLINE\CBA86CBC\EDBFA323\AME_BESDominoSensor64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\3FA32B8B\445B24B1\AE_Agent_Plugin.dll
- %TEMP%\mia2.tmp\data\OFFLINE\D_\BuildDrive\DGBuildAgent5_3_2\Agent\win\bin\release64\DgService.exe
- %TEMP%\mia2.tmp\data\OFFLINE\6ED47C4E\445B24B1\DgUpdate.exe
- %TEMP%\mia2.tmp\data\OFFLINE\D_\BuildDrive\DGBuildAgent5_3_2\Agent\win\bin\release32\DgService.exe
- %TEMP%\mia2.tmp\data\OFFLINE\D_\BuildDrive\DGBuildAgent5_3_2\Agent\win\bin\release32\DgScan.exe
- %TEMP%\mia2.tmp\data\OFFLINE\D_\BuildDrive\DGBuildAgent5_3_2\Agent\win\bin\release64\DgScan.exe
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiinst.exe
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiinst.exe
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msiexec.exe
- %TEMP%\mia2.tmp\data\OFFLINE\D0BE37E0\EDBFA323\InstallPlugins.exe
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msiexec.exe
- %TEMP%\mia2.tmp\data\OFFLINE\8A63BAC8\EDBFA323\AME_OutlookSensor64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\3AF7145C\445B24B1\DGCIVrfy.dll
- %TEMP%\mia2.tmp\data\OFFLINE\7A9E1D1F\EDBFA323\DGCIVrfy.dll
- %TEMP%\mia2.tmp\data\OFFLINE\D8192924\EDBFA323\DGCI2.dll
- %TEMP%\mia2.tmp\data\OFFLINE\D7AF3999\EDBFA323\DgApiWOW64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\590D0065\445B24B1\DGCI2.dll
- %TEMP%\mia2.tmp\data\OFFLINE\6157C05\EDBFA323\DGClassify.dll
- %TEMP%\mia2.tmp\data\OFFLINE\4E5C94D5\445B24B1\DgClient.dll
- %TEMP%\mia2.tmp\data\OFFLINE\D6352861\445B24B1\DGClassify.dll
- %TEMP%\mia2.tmp\data\OFFLINE\95EE6C0E\445B24B1\DGCI_ATTIVIO.DLL
- %TEMP%\mia2.tmp\data\OFFLINE\CAB82F07\EDBFA323\DGCI_ATTIVIO.DLL
- %TEMP%\mia2.tmp\data\OFFLINE\709109C\EDBFA323\DgApi64.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\cabinet.dll
- %TEMP%\mia2.tmp\data\OFFLINE\E29B8E97\445B24B1\COM_Sensor.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\cabinet.dll
- %TEMP%\mia2.tmp\data\OFFLINE\10866080\445B24B1\AME_SmtpSensor.dll
- %TEMP%\mia2.tmp\data\OFFLINE\754347DB\EDBFA323\AME_SmtpSensor64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\7B5227A\445B24B1\DgApi.dll
- %TEMP%\mia2.tmp\data\OFFLINE\B619B23D\445B24B1\DgApi.dll
- %TEMP%\mia2.tmp\data\OFFLINE\3EBACB31\EDBFA323\COT_Agent_PlugIn.dll
- %TEMP%\mia2.tmp\data\OFFLINE\16471ED5\EDBFA323\COM_Sensor64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\6EEACF4D\445B24B1\COT_Agent_PlugIn.dll
- %TEMP%\mia2.tmp\data\OFFLINE\E2CE85B1\7B0DC95D\BaseAgentConfig.xml
- %TEMP%\mia2.tmp\data\OFFLINE\546F103E\3E77515B\DgRuleMeta.xml
- %TEMP%\mia2.tmp\data\OFFLINE\54C48566\6F2B25E4\ameCfg.xml
- %TEMP%\mia2.tmp\data\OFFLINE\DFD1D344\E7EC687B\block.bmp
- %TEMP%\mia2.tmp\data\OFFLINE\B80EE0D4\1FDC7102\impflt.bin
- %TEMP%\mia2.tmp\data\OFFLINE\3EF60F16\65A7E05A\highgroup.txt
- %TEMP%\mia2.tmp\data\OFFLINE\B46E8A5A\1FDC7102\winver_2003_x64.reg
- %TEMP%\mia2.tmp\data\OFFLINE\30B4A4F6\E7EC687B\Block.txt
- %TEMP%\mia2.tmp\data\OFFLINE\D4091B9B\7B0DC95D\flags.xml
- %TEMP%\mia2.tmp\data\OFFLINE\BC4E2B0B\A2E42D80\manifest.xml
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\instmsi.msi
- %TEMP%\532_0194\SEC01\CERTGUID.DAT
- %TEMP%\532_0194\SEC01\DgServer.cer
- %TEMP%\532_0194\SEC01\agent7.ini
- %TEMP%\532_0194\SEC01\DGBaseAgent.exe
- %TEMP%\532_0194\SEC01\agentXp.ini
- %TEMP%\mia2.tmp\DGAgentSetup.msi
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\instmsi.msi
- %TEMP%\mia2.tmp\data\DGAgentSetup.msi
- %TEMP%\532_0194\SEC01\configXp.xml
- %TEMP%\532_0194\SEC01\config7.xml
- %TEMP%\mia2.tmp\data\OFFLINE\B946B2CE\1FDC7102\winver_2003_x86.reg
- %TEMP%\mia2.tmp\data\OFFLINE\D94D90B4\445B24B1\DgAgent.exe
- %TEMP%\mia2.tmp\data\OFFLINE\C0ECEBD2\EDBFA323\DgAgent.exe
- %TEMP%\mia2.tmp\data\OFFLINE\F715BFF\445B24B1\DG-Diag.exe
- %TEMP%\mia2.tmp\data\OFFLINE\63793855\445B24B1\COT_Test_App.exe
- %TEMP%\mia2.tmp\data\OFFLINE\D536012\EDBFA323\COT_Test_App.exe
- %TEMP%\mia2.tmp\data\OFFLINE\38155F39\445B24B1\DgPrompt.exe
- %TEMP%\mia2.tmp\data\OFFLINE\3134EEB5\EDBFA323\DgPrompt.exe
- %TEMP%\mia2.tmp\data\OFFLINE\DF8961B3\445B24B1\DgCleaner.exe
- %TEMP%\mia2.tmp\DGAgentSetup.exe
- %TEMP%\mia2.tmp\data\OFFLINE\160878D2\445B24B1\DGCipher.exe
- %TEMP%\mia2.tmp\data\OFFLINE\CF8AF9CF\445B24B1\SubclassExclusionList.ini
- %TEMP%\mia2.tmp\data\OFFLINE\D6BA87D7\1FDC7102\winver_2008_x86.reg
- %TEMP%\mia2.tmp\data\OFFLINE\A58847B4\1FDC7102\winver_7_x64.reg
- %TEMP%\mia2.tmp\data\OFFLINE\BBA23E9E\1FDC7102\winver_2008_x64.reg
- %TEMP%\mia2.tmp\data\OFFLINE\A846A0C3\1FDC7102\winver_2008r2_x64.reg
- %TEMP%\mia2.tmp\data\OFFLINE\F75B180D\1FDC7102\winver_2008r2_x86.reg
- %TEMP%\mia2.tmp\data\OFFLINE\AF9F5F4D\1FDC7102\winver_xp_x64.reg
- %TEMP%\mia2.tmp\data\OFFLINE\7DBFFAD5\1FDC7102\winver_xp_x86.reg
- %TEMP%\mia2.tmp\data\OFFLINE\7398B9F6\1FDC7102\winver_vista_x86.reg
- %TEMP%\mia2.tmp\data\OFFLINE\4A076369\1FDC7102\winver_7_x86.reg
- %TEMP%\mia2.tmp\data\OFFLINE\20BC8876\1FDC7102\winver_vista_x64.reg
- %TEMP%\mia2.tmp\data\OFFLINE\8C41B979\EDBFA323\DGCotMan.sys
- %TEMP%\mia2.tmp\data\OFFLINE\B5C2C345\445B24B1\dgdmk.sys
- %TEMP%\mia2.tmp\data\OFFLINE\51D1E669\445B24B1\DGCotMan.sys
- %TEMP%\mia2.tmp\data\OFFLINE\9F7C992C\445B24B1\DGBUSMon.sys
- %TEMP%\mia2.tmp\data\OFFLINE\D2DE42DB\EDBFA323\DGBUSMon.sys
- %TEMP%\mia2.tmp\data\OFFLINE\BA7032B8\445B24B1\DgDmkDisk.sys
- %TEMP%\mia2.tmp\data\OFFLINE\5EC35659\4D80942E\DgDmkDisk.sys
- %TEMP%\mia2.tmp\data\OFFLINE\578E2C83\E0ACC3F3\dgdmk.sys
- %TEMP%\mia2.tmp\data\OFFLINE\F7CB267F\4D80942E\dgdmk.sys
- %TEMP%\mia2.tmp\data\OFFLINE\5C226AF1\EDBFA323\dgdmk.sys
- %TEMP%\mia2.tmp\data\OFFLINE\D3D43093\EDBFA323\DGAPIMon.sys
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\usp10.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\usp10.dll
- %TEMP%\mia2.tmp\data\OFFLINE\8B9F71D8\EDBFA323\Stingray.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\shfolder.dll
- %TEMP%\mia2.tmp\data\OFFLINE\10B679F7\445B24B1\Stingray.dll
- %TEMP%\mia2.tmp\data\OFFLINE\1C5DA0DD\6FE18AA0\XceedZipX64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\11D18952\445B24B1\DGAPIMon.sys
- %TEMP%\mia2.tmp\data\OFFLINE\1C1A2672\6FE18AA0\XceedZipX64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\A793E99F\6FE18AA0\XceedZip.dll
- %TEMP%\mia2.tmp\data\OFFLINE\A89D53D9\6FE18AA0\XceedZip.dll
- %TEMP%\mia2.tmp\data\OFFLINE\2E389420\EDBFA323\DgDmkDisk.sys
- %TEMP%\mia2.tmp\data\OFFLINE\1B3FE408\4D80942E\dglfs.sys
- %TEMP%\mia2.tmp\data\OFFLINE\624FB56D\EDBFA323\dglfs.sys
- %TEMP%\mia2.tmp\data\OFFLINE\2D0012E1\445B24B1\dglfs.sys
- %TEMP%\mia2.tmp\data\OFFLINE\92E86AF9\445B24B1\DGKPMail.sys
- %TEMP%\mia2.tmp\data\OFFLINE\F4D1EFA1\EDBFA323\DGKPMail.sys
- %TEMP%\mia2.tmp\data\OFFLINE\399745CE\445B24B1\DGRule.sys
- %TEMP%\mia2.tmp\data\OFFLINE\51DA036\EDBFA323\DGRule.sys
- %TEMP%\mia2.tmp\data\OFFLINE\FDA1F175\EDBFA323\DGMaster.sys
- %TEMP%\mia2.tmp\data\OFFLINE\E3F2985A\E0ACC3F3\dglfs.sys
- %TEMP%\mia2.tmp\data\OFFLINE\29D360B6\445B24B1\DGMaster.sys
- %TEMP%\mia2.tmp\data\OFFLINE\5099E4E\EDBFA323\dgfsmon.sys
- %TEMP%\mia2.tmp\data\OFFLINE\2D7610EB\EDBFA323\dgdt.sys
- %TEMP%\mia2.tmp\data\OFFLINE\148CB4FE\E0ACC3F3\dgdt.sys
- %TEMP%\mia2.tmp\data\OFFLINE\B9A9146F\4D80942E\dgdt.sys
- %TEMP%\mia2.tmp\data\OFFLINE\32AD0733\E0ACC3F3\DgDmkDisk.sys
- %TEMP%\mia2.tmp\data\OFFLINE\D928CC51\445B24B1\dgdt.sys
- %TEMP%\mia2.tmp\data\OFFLINE\B336E0B4\E0ACC3F3\dgfs.sys
- %TEMP%\mia2.tmp\data\OFFLINE\D53C056E\445B24B1\dgfsmon.sys
- %TEMP%\mia2.tmp\data\OFFLINE\360E13B\EDBFA323\dgfs.sys
- %TEMP%\mia2.tmp\data\OFFLINE\A8158BFE\445B24B1\dgfs.sys
- %TEMP%\mia2.tmp\data\OFFLINE\2BC9393F\4D80942E\dgfs.sys
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mIDEFunc.dll\mEXEFunc.dll
- %TEMP%\mia2.tmp\data\mIDEFunc.dll\mEXEFunc.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\imagehlp.dll
- %TEMP%\mia2.tmp\data\OFFLINE\F5106A43\1FDC7102\dg_gdiplus.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\imagehlp.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msi.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msihnd.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msi.dll
- %TEMP%\mia2.tmp\data\OFFLINE\mIDEFunc.dll\mEXEFunc.dll
- %TEMP%\mia2.tmp\data\OFFLINE\F9FDC1C1\D61F633C\MFC71u.dll
- %TEMP%\mia2.tmp\data\OFFLINE\869B8A8\EDBFA323\DGShlExt.dll
- %TEMP%\mia2.tmp\data\OFFLINE\1574AA8B\EDBFA323\DGImager64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\6E707823\445B24B1\DgRemedAgentHelper.dll
- %TEMP%\mia2.tmp\data\OFFLINE\24BB327F\445B24B1\DGImager.dll
- %TEMP%\mia2.tmp\data\OFFLINE\826B3510\EDBFA323\DgClient.dll
- %TEMP%\mia2.tmp\data\OFFLINE\D768B441\445B24B1\DGDctm.dll
- %TEMP%\mia2.tmp\data\OFFLINE\E8D6118C\EDBFA323\DgRemed_WebPerformanceA64.dll
- %TEMP%\mia2.tmp\data\OFFLINE\E87DE55C\445B24B1\DGShlExt.dll
- %TEMP%\mia2.tmp\data\OFFLINE\5D0F01D2\445B24B1\DgRemed_WebPerformanceA.dll
- %TEMP%\mia2.tmp\data\OFFLINE\77C4A366\445B24B1\DgRemediation.dll
- %TEMP%\mia2.tmp\data\OFFLINE\A81EA9CA\EDBFA323\DgRemediation64.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msihnd.dll
- %TEMP%\mia2.tmp\data\OFFLINE\20F08F1E\445B24B1\OS_Plugin.dll
- %TEMP%\mia2.tmp\data\OFFLINE\C344B111\EDBFA323\OS_Plugin64.dll
- %TEMP%\mia2.tmp\data\mWinRun.dll\mWinRunExec.dll
- %TEMP%\mia2.tmp\data\OFFLINE\7E390A11\D61F633C\msvcr71.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\mWinRunExec.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\sdbapiU.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\shfolder.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\sdbapi.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\riched20.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\riched20.dll
- %TEMP%\mia2.tmp\data\msvcr71.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msisip.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msls31.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msisip.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\msimsg.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msimsg.dll
- %TEMP%\mia2.tmp\data\msvcp71.dll
- %TEMP%\mia2.tmp\data\OFFLINE\8E1792CB\D61F633C\msvcp71.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\mspatcha.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\ansi\msls31.dll
- %TEMP%\mia2.tmp\data\Microsoft Windows Installer 2.0\mWinRun.dll\unicode\mspatcha.dll
Sets the 'hidden' attribute to the following files:
- C:\Config.Msi\3d034.rbf
- C:\Config.Msi\3d033.rbf
- C:\Config.Msi\3d035.rbf
- C:\Config.Msi\3d037.rbf
- C:\Config.Msi\3d036.rbf
- C:\Config.Msi\3d032.rbf
- C:\Config.Msi\3d02c.rbf
- C:\Config.Msi\3d02b.rbf
- C:\Config.Msi\3d02f.rbf
- C:\Config.Msi\3d031.rbf
- C:\Config.Msi\3d030.rbf
Deletes the following files:
- C:\Config.Msi\3d032.rbf
- C:\Config.Msi\3d033.rbf
- C:\Config.Msi\3d034.rbf
- C:\Config.Msi\3d031.rbf
- C:\Config.Msi\3d02e.rbf
- C:\Config.Msi\3d02f.rbf
- C:\Config.Msi\3d030.rbf
- %WINDIR%\Installer\3d027.msi
- %TEMP%\{917BAAEA-297A-4B35-ACDD-A26C47D64DF6}
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\1635468cecbd5d6c55a5d992847bd833_23ef5514-3059-436f-a4a7-4cefaab20eb1
- C:\Config.Msi\3d02a.rbs
- C:\Config.Msi\3d035.rbf
- C:\Config.Msi\3d036.rbf
- C:\Config.Msi\3d037.rbf
- C:\Config.Msi\3d02d.rbf
- C:\Config.Msi\3d025.rbs
- %WINDIR%\Installer\3d022.msi
- %TEMP%\flags.xml
- %WINDIR%\Installer\MSI4.tmp
- %TEMP%\lang.loc
- %TEMP%\mia.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSIB.tmp
- C:\Config.Msi\3d02b.rbf
- C:\Config.Msi\3d02c.rbf
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI9.tmp
Moves the following system files:
- from <SYSTEM32>\msvcp71.dll to C:\Config.Msi\3d02e.rbf
- from <SYSTEM32>\msvcr71.dll to C:\Config.Msi\3d02d.rbf
Moves the following files:
- from C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\AME_OutlookSensor.dll to C:\Config.Msi\3d035.rbf
- from C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\AME_SmtpSensor.dll to C:\Config.Msi\3d036.rbf
- from C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\AE_Agent_Plugin.dll to C:\Config.Msi\3d033.rbf
- from C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\AME_NotesSensor.dll to C:\Config.Msi\3d034.rbf
- from C:\Programmi\DGAgent\Misc\DgCleaner.exe to C:\Programmi\DGAgent\Misc\Misc.res
- from C:\Programmi\DGAgent\config.xml to C:\Programmi\DGAgent\config.xml.old
- from C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\XceedZip.dll to C:\Config.Msi\3d037.rbf
- from C:\Programmi\DGAgent\BaseAgentConfig.xml to C:\Programmi\DGAgent\config.xml
- from C:\Programmi\DGAgent\DGImager.dll to C:\Config.Msi\3d02b.rbf
- from C:\Programmi\DGAgent\SubclassExclusionList.ini to C:\Config.Msi\3d02c.rbf
- from %TEMP%\532_0194\SEC01\configXp.xml to %TEMP%\532_0194\SEC01\config.xml
- from %TEMP%\532_0194\SEC01\agentXp.ini to %TEMP%\532_0194\SEC01\agent.ini
- from C:\Programmi\DGAgent\plugins\8e4ea70a-6128-4b57-bd3f-8e9e0f0da6bb\COM_Sensor.dll to C:\Config.Msi\3d031.rbf
- from C:\Programmi\DGAgent\plugins\09D849B6-32D3-4a40-85EE-6B84BA29E35B\AE_MailSensor_Plugin.dll to C:\Config.Msi\3d032.rbf
- from C:\Programmi\DGAgent\dirctrl.dat to C:\Config.Msi\3d02f.rbf
- from C:\Programmi\DGAgent\plugins\8e4ea70a-6128-4b57-bd3f-8e9e0f0da6bb\OS_Plugin.dll to C:\Config.Msi\3d030.rbf
Network activity:
Connects to:
- '20#.#6.232.182':80
- 'wp#d':80
TCP:
HTTP GET requests:
- 20#.#6.232.182/pki/crl/products/CSPCA.crl
- wp#d/wpad.dat
UDP:
- DNS ASK crl.microsoft.com
- DNS ASK wp#d