Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\cscript.exe' "C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ALU137_Install_DetermineOS.vbs"
- '<SYSTEM32>\cscript.exe' "C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ALU_PreInstallV2.vbs"
- '<SYSTEM32>\cscript.exe' "C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\Scripts\PrePack.vbs" SONICWALLAVENTAILCONNECT1006XPW7.EXE INSTALL
Executes the following:
- '<SYSTEM32>\msiexec.exe' /i "%ALLUSERSPROFILE%\Application Data\Aventail\ngvpn.msi" /qn /lvx "%ALLUSERSPROFILE%\Application Data\Aventail\ngmsi.log" NGSETUP=1 ALLUSERS=1 CONFIGURATIONFILE="%ALLUSERSPROFILE%\Application...
- 'C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ngsetup_en_10.6.exe' -silent -logging -f=C:\TEMP\alcatel-lucent.ini
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 31179FDFD0794E439624B2D4F50E4956 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' /Y "%WINDIR%\ngwinx.dll"
- '<SYSTEM32>\cmd.exe' /X /C C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\start.bat
- 'C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\start.EXE' SONICWALLAVENTAILCONNECT1006XPW7.EXE
- 'C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner.exe' MAN INSTALL SONICWALLAVENTAILCONNECT1006XPW7.EXE FORCE
- '<SYSTEM32>\cmd.exe' /c "C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ngsetup_en_10.6.exe" -silent -logging -f=C:\TEMP\alcatel-lucent.ini
- 'C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\SonicWallAventailConnect1006XPW7.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\ngmsgs.dll
- %WINDIR%\ngwinx.dll
- <SYSTEM32>\ngclient.dll
- <SYSTEM32>\ngras.dll
- %ProgramFiles%\Aventail Connect\SourceDir\ngvpn.cat
- <SYSTEM32>\nglocenu.dll
- <SYSTEM32>\ngvpnmgr.exe
- <SYSTEM32>\ngupdate.exe
- <SYSTEM32>\ngmonitor.exe
- %WINDIR%\Temp\Top.bmp
- %WINDIR%\inf\ngvpn.inf
- <DRIVERS>\ngwfp.sys
- %TEMP%\~DFA80A.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\3a367.ipi
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\0797C381B2F87EB5A1D5573BD15BA4F4
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\0797C381B2F87EB5A1D5573BD15BA4F4
- C:\Config.Msi\3a368.rbs
- <SYSTEM32>\ngdial.exe
- <DRIVERS>\nglog.sys
- <DRIVERS>\ngvpn.sys
- %TEMP%\Cab7.tmp
- %TEMP%\Cab9.tmp
- %WINDIR%\ngutil.exe
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ngvpn.CAT
- %WINDIR%\LastGood\TMPB.tmp
- %ALLUSERSPROFILE%\Application Data\Aventail\ngwfp.sys
- %ALLUSERSPROFILE%\Application Data\Aventail\nglog.sys
- %ALLUSERSPROFILE%\Application Data\Aventail\ngfilter.sys
- %WINDIR%\Temp\OLDC.tmp
- <DRIVERS>\SET10.tmp
- %WINDIR%\LastGood\TMP11.tmp
- %WINDIR%\Temp\OLDF.tmp
- <DRIVERS>\SETD.tmp
- %WINDIR%\LastGood\TMPE.tmp
- %ALLUSERSPROFILE%\Application Data\Aventail\ngvpn.sys
- %ProgramFiles%\Aventail Connect\ng.ico
- <SYSTEM32>\ngcommon.dll
- <SYSTEM32>\nglogon.dll
- %ProgramFiles%\Aventail Connect\Install\DIFxAPI.dll
- <DRIVERS>\ngfilter.sys
- <SYSTEM32>\nghelp.chm
- %ALLUSERSPROFILE%\Application Data\Aventail\ngvpn.inf
- %ALLUSERSPROFILE%\Application Data\Aventail\ngvpn.cat
- %WINDIR%\ngmsi.dll
- %WINDIR%\ngevent.dll
- %ProgramFiles%\Aventail Connect\Install\ngvpn.cat
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\BANNER\GREY.gif
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\BANNER\pskill.exe
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\BANNER\BGAL.gif
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\BANNER\02_B.hta
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\BANNER\AL_IT.jpg
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\BANNER\version_11.txt
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\SCRIPTS\PrePack.vbs
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\SCRIPTS\pskill.exe
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\SCRIPTS\PostPack.vbs
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\SCRIPTS\Message.vbs
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\SCRIPTS\Message2.vbs
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner.exe
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ALU137_Install_DetermineOS.vbs.bak2
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ALU137_PostUninstall.vbs
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ALU137_Install_DetermineOS.vbs
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\start.EXE
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\alcatel-lucent.ini
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ALU_32_64_Uninstall.vbs
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ngsetup64_en_10.6.exe
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ngsetup_en_10.6.exe
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ALU_PreInstallV2.vbs.bak2
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ALU_Config.ini
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ALU_PreInstallV2.vbs
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\Runner_Tools\SCRIPTS\version_36.txt
- %ALLUSERSPROFILE%\Application Data\Aventail\ngmsi.log
- %WINDIR%\Installer\3a365.msi
- %ALLUSERSPROFILE%\Application Data\Aventail\ngsetup.ini
- %ALLUSERSPROFILE%\Application Data\Aventail\ngsetup.log
- %ALLUSERSPROFILE%\Application Data\Aventail\ngvpn.msi
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %TEMP%\Cab3.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- C:\temp\alcatel-lucent.ini
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\SonicWallAventailConnect1006XPW7.INI
- %TEMP%\GLC1.tmp
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\SonicWallAventailConnect1006XPW7.exe
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ServiceUI_x64.exe
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\ServiceUI_x86.exe
- C:\temp\standalone\SONICWALLAVENTAILCONNECT1006XPW7\start.bat
- %TEMP%\~DF5921.tmp
- %WINDIR%\PACKMAN\LOGS\SONICWALLAVENTAILCONNECT1006XPW7.log
- %WINDIR%\PACKMAN\LOGS\PACKAGES.INI
- %WINDIR%\PACKMAN\LOGS\runner.txt
- %WINDIR%\PACKMAN\CONF\PC_Conf.ini
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ngvpn.CAT
Deletes the following files:
- <DRIVERS>\ngvpn.sys
- <DRIVERS>\ngfilter.sys
- %TEMP%\Cab9.tmp
- %TEMP%\Cab3.tmp
- %TEMP%\Cab7.tmp
Moves the following files:
- from %WINDIR%\LastGood\TMPE.tmp to %WINDIR%\LastGood\system32\DRIVERS\ngfilter.sys
- from %WINDIR%\LastGood\TMPB.tmp to %WINDIR%\LastGood\system32\DRIVERS\ngvpn.sys
Network activity:
Connects to:
- 'crl.verisign.com':80
- 'cs#######-2-crl.verisign.com':80
- 'wp#d':80
- 'www.download.windowsupdate.com':80
TCP:
HTTP GET requests:
- http://crl.verisign.com/pca3.crl
- http://cs#######-2-crl.verisign.com/CSC3-2009-2.crl
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- http://11#.#11.111.1/wpad.dat via wp#d
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
UDP:
- DNS ASK crl.verisign.com
- DNS ASK cs#######-2-crl.verisign.com
- DNS ASK wp#d
- DNS ASK www.download.windowsupdate.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MsiDialogCloseClass' WindowName: 'Aventail Connect Setup Wizard'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
