Technical Information
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Activeris AntiMalware\ActiverisAntiMalware.exe' -silentscan
- '%TEMP%\is-G7C47.tmp\amsetup_activeris_default_socialads.tmp' /SL5="$30092,4286345,132096,%TEMP%\amsetup_activeris_default_socialads.exe" /verysilent
- '%TEMP%\amsetup_activeris_default_socialads.exe' /verysilent
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im "appmanager.exe"
- '<SYSTEM32>\taskkill.exe' /f /im "ActiverisAntiMalware.exe"
Searches for windows to
detect analytical utilities:
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: '(null)'
- ClassName: 'RegMonClass' WindowName: '(null)'
- ClassName: 'FileMonClass' WindowName: '(null)'
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Activeris AntiMalware\is-BBSKM.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-FFPQ6.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-BVT65.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-OLL8A.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\clamunpack\is-DM58A.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\clamunpack\is-KRNRU.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\clamunpack\is-IGCMM.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-L6TN2.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-2CCAE.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-LVMPB.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-CIPAG.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-JJ8ID.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-B3KB9.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-SE2GT.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-MSS1H.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404
- %APPDATA%\Activeris\Activeris AntiMalware\1.0.0.1\ASPLog.txt
- %APPDATA%\Activeris\Activeris AntiMalware\Settings.db
- %APPDATA%\Activeris\Activeris AntiMalware\Settings.db-journal
- %ALLUSERSPROFILE%\Start Menu\Programs\Activeris AntiMalware\Activeris AntiMalware.lnk
- %PROGRAM_FILES%\Activeris AntiMalware\is-KABGR.tmp
- %ALLUSERSPROFILE%\Application Data\Activeris\Activeris AntiMalware\is-9EP7S.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Activeris AntiMalware\Register Activeris AntiMalware.lnk
- %PROGRAM_FILES%\Activeris AntiMalware\unins000.dat
- %ALLUSERSPROFILE%\Desktop\Activeris AntiMalware.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Activeris AntiMalware\Uninstall Activeris AntiMalware.lnk
- %PROGRAM_FILES%\Activeris AntiMalware\is-9QQOP.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-Q3819.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-IE6F7.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-3TN0J.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-04Q13.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-R0NMB.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-K752R.tmp
- %TEMP%\is-G7C47.tmp\amsetup_activeris_default_socialads.tmp
- %TEMP%\amsetup_activeris_default_socialads.exe
- %TEMP%\nsw2.tmp
- %TEMP%\is-P22E2.tmp\_isetup\_shfoldr.dll
- <SYSTEM32>\acrisnative32.exe
- %TEMP%\is-P22E2.tmp\acrisnative32.exe
- %TEMP%\is-P22E2.tmp\isxdl.dll
- %PROGRAM_FILES%\Activeris AntiMalware\is-BV854.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-US4MR.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-BETH4.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-07JF8.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-TDP0N.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-VH6RV.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-A811I.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-R8OKA.tmp
- %ALLUSERSPROFILE%\Application Data\Activeris\Activeris AntiMalware\is-M415B.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-AAMDP.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-MO30H.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-LDF5D.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-RCJ8A.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-VSCRC.tmp
- %PROGRAM_FILES%\Activeris AntiMalware\is-E4MP1.tmp
Deletes the following files:
- %TEMP%\is-G7C47.tmp\amsetup_activeris_default_socialads.tmp
- %TEMP%\amsetup_activeris_default_socialads.exe
- %APPDATA%\Activeris\Activeris AntiMalware\Settings.db-journal
- %TEMP%\is-P22E2.tmp\acrisnative32.exe
- %TEMP%\is-P22E2.tmp\isxdl.dll
- %TEMP%\is-P22E2.tmp\_isetup\_shfoldr.dll
Moves the following files:
- from %PROGRAM_FILES%\Activeris AntiMalware\is-SE2GT.tmp to %PROGRAM_FILES%\Activeris AntiMalware\swedish_asp_SV.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-CIPAG.tmp to %PROGRAM_FILES%\Activeris AntiMalware\spanish_asp_ES.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-JJ8ID.tmp to %PROGRAM_FILES%\Activeris AntiMalware\Xceed.Compression.dll
- from %PROGRAM_FILES%\Activeris AntiMalware\is-B3KB9.tmp to %PROGRAM_FILES%\Activeris AntiMalware\unrar.dll
- from %PROGRAM_FILES%\Activeris AntiMalware\is-L6TN2.tmp to %PROGRAM_FILES%\Activeris AntiMalware\russian_asp_ru.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-VH6RV.tmp to %PROGRAM_FILES%\Activeris AntiMalware\japanese_asp_JA.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-A811I.tmp to %PROGRAM_FILES%\Activeris AntiMalware\italian_asp_IT.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-2CCAE.tmp to %PROGRAM_FILES%\Activeris AntiMalware\portuguese_asp_PT-BR.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-LVMPB.tmp to %PROGRAM_FILES%\Activeris AntiMalware\norwegian_asp_NO.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-BVT65.tmp to %PROGRAM_FILES%\Activeris AntiMalware\Xceed.Compression.Formats.dll
- from %PROGRAM_FILES%\Activeris AntiMalware\is-MSS1H.tmp to %PROGRAM_FILES%\Activeris AntiMalware\filetypehelper.exe
- from %PROGRAM_FILES%\Activeris AntiMalware\clamunpack\is-DM58A.tmp to %PROGRAM_FILES%\Activeris AntiMalware\clamunpack\readme.txt
- from %PROGRAM_FILES%\Activeris AntiMalware\is-KABGR.tmp to %PROGRAM_FILES%\Activeris AntiMalware\loading_withWhiteBG.avi
- from %ALLUSERSPROFILE%\Application Data\Activeris\Activeris AntiMalware\is-9EP7S.tmp to %ALLUSERSPROFILE%\Application Data\Activeris\Activeris AntiMalware\AddonSafelist
- from %PROGRAM_FILES%\Activeris AntiMalware\clamunpack\is-KRNRU.tmp to %PROGRAM_FILES%\Activeris AntiMalware\clamunpack\libclamav.dll
- from %PROGRAM_FILES%\Activeris AntiMalware\is-BBSKM.tmp to %PROGRAM_FILES%\Activeris AntiMalware\Xceed.Zip.dll
- from %PROGRAM_FILES%\Activeris AntiMalware\is-FFPQ6.tmp to %PROGRAM_FILES%\Activeris AntiMalware\Xceed.FileSystem.dll
- from %PROGRAM_FILES%\Activeris AntiMalware\clamunpack\is-IGCMM.tmp to %PROGRAM_FILES%\Activeris AntiMalware\clamunpack\clamscan.exe
- from %PROGRAM_FILES%\Activeris AntiMalware\is-OLL8A.tmp to %PROGRAM_FILES%\Activeris AntiMalware\scandll.dll
- from %PROGRAM_FILES%\Activeris AntiMalware\is-R8OKA.tmp to %PROGRAM_FILES%\Activeris AntiMalware\german_asp_DE.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-04Q13.tmp to %PROGRAM_FILES%\Activeris AntiMalware\Microsoft.Win32.TaskScheduler.DLL
- from %PROGRAM_FILES%\Activeris AntiMalware\is-R0NMB.tmp to %PROGRAM_FILES%\Activeris AntiMalware\acrissys.dll
- from %PROGRAM_FILES%\Activeris AntiMalware\is-MO30H.tmp to %PROGRAM_FILES%\Activeris AntiMalware\System.Core.dll
- from %PROGRAM_FILES%\Activeris AntiMalware\is-BV854.tmp to %PROGRAM_FILES%\Activeris AntiMalware\System.Data.SQLite.dll
- from %PROGRAM_FILES%\Activeris AntiMalware\is-K752R.tmp to %PROGRAM_FILES%\Activeris AntiMalware\AppResource.dll
- from %PROGRAM_FILES%\Activeris AntiMalware\is-Q3819.tmp to %PROGRAM_FILES%\Activeris AntiMalware\ActiverisAntiMalware.exe
- from %PROGRAM_FILES%\Activeris AntiMalware\is-IE6F7.tmp to %PROGRAM_FILES%\Activeris AntiMalware\unins000.exe
- from %PROGRAM_FILES%\Activeris AntiMalware\is-3TN0J.tmp to %PROGRAM_FILES%\Activeris AntiMalware\AppManager.exe
- from %PROGRAM_FILES%\Activeris AntiMalware\is-9QQOP.tmp to %PROGRAM_FILES%\Activeris AntiMalware\ActiverisAntiMalware.exe.config
- from %PROGRAM_FILES%\Activeris AntiMalware\is-AAMDP.tmp to %PROGRAM_FILES%\Activeris AntiMalware\asp.ico
- from %PROGRAM_FILES%\Activeris AntiMalware\is-BETH4.tmp to %PROGRAM_FILES%\Activeris AntiMalware\dutch_asp_NL.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-07JF8.tmp to %PROGRAM_FILES%\Activeris AntiMalware\danish_asp_DA.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-TDP0N.tmp to %PROGRAM_FILES%\Activeris AntiMalware\french_asp_FR.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-US4MR.tmp to %PROGRAM_FILES%\Activeris AntiMalware\Finnish_asp_FI.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-RCJ8A.tmp to %PROGRAM_FILES%\Activeris AntiMalware\Chinese_asp_ZH-CN.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-LDF5D.tmp to %PROGRAM_FILES%\Activeris AntiMalware\Interop.IWshRuntimeLibrary.dll
- from %ALLUSERSPROFILE%\Application Data\Activeris\Activeris AntiMalware\is-M415B.tmp to %ALLUSERSPROFILE%\Application Data\Activeris\Activeris AntiMalware\log.xslt
- from %PROGRAM_FILES%\Activeris AntiMalware\is-VSCRC.tmp to %PROGRAM_FILES%\Activeris AntiMalware\eng_asp_en.ini
- from %PROGRAM_FILES%\Activeris AntiMalware\is-E4MP1.tmp to %PROGRAM_FILES%\Activeris AntiMalware\categories.ini
Network activity:
Connects to:
- 'cr#.##modoca.com':80
- 'cr#.##ertrust.com':80
- 'wp#d':80
TCP:
HTTP GET requests:
- cr#.##modoca.com/COMODOCodeSigningCA2.crl
- cr#.##ertrust.com/UTN-USERFirst-Object.crl
- wp#d/wpad.dat
UDP:
- DNS ASK cr#.##modoca.com
- DNS ASK cr#.##ertrust.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'