Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\UVNC_Service] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\UVNC_Service] 'ImagePath' = '"%ProgramFiles(x86)%\Eickmann Computer\Fernwartung\winvnc.exe" -service'
Creates the following services
- 'UVNC_Service' "%ProgramFiles(x86)%\Eickmann Computer\Fernwartung\winvnc.exe" -service
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\eickmann computer\fernwartung\ultravnc.ini
- %ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung herr auer.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung herr eickmann.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung lami.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung port 80.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung secure port.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung whm.lnk
- %HOMEPATH%\desktop\fernwartung eickmann computer.lnk
- %TEMP%\eickmann computer fernwartungs install service log.txt
- %ProgramFiles(x86)%\eickmann computer\fernwartung\vnchooks.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung ahm.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung ehnb.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung frau bristow.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung frau wiesner.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung herr auer.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung herr eickmann.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung lami.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung port 80.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung secure port.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung frau bristow.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung frau wiesner.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung ehnb.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung ehm.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung ahm.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\uvnc_settings.exe
- %ProgramFiles(x86)%\eickmann computer\fernwartung\vncscai.exe
- %ProgramFiles(x86)%\eickmann computer\fernwartung\winvnc.exe
- %ProgramFiles(x86)%\eickmann computer\fernwartung\authadmin.dll
- %ProgramFiles(x86)%\eickmann computer\fernwartung\authssp.dll
- %ProgramFiles(x86)%\eickmann computer\fernwartung\ldapauth.dll
- %ProgramFiles(x86)%\eickmann computer\fernwartung\logging.dll
- %ProgramFiles(x86)%\eickmann computer\fernwartung\logmessages.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung whm.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung ehm.lnk
- %ProgramFiles(x86)%\eickmann computer\fernwartung\unzip32.dll
- %ProgramFiles(x86)%\eickmann computer\fernwartung\zip32.dll
- %ProgramFiles(x86)%\eickmann computer\fernwartung\logo.gif
- %ProgramFiles(x86)%\eickmann computer\fernwartung\vncscai.exe.manifest
- %ProgramFiles(x86)%\eickmann computer\fernwartung\cad.exe.manifest
- %ProgramFiles(x86)%\eickmann computer\fernwartung\winvnc.exe.manifest
- %ProgramFiles(x86)%\eickmann computer\fernwartung\eickmaus.ico
- %ProgramFiles(x86)%\eickmann computer\fernwartung\vncscai_installservice_wennadmin.exe
- %ProgramFiles(x86)%\eickmann computer\fernwartung\vncscaism.exe
- %ProgramFiles(x86)%\eickmann computer\fernwartung\cad.exe
- %ProgramFiles(x86)%\eickmann computer\fernwartung\workgrpdomnt4.dll
- %TEMP%\eickmann computer fernwartungs log.txt
Network activity
Connects to
- 'localhost':5900
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\eickmann computer\fernwartung\vncscai_installservice_wennadmin.exe'
- '%ProgramFiles(x86)%\eickmann computer\fernwartung\winvnc.exe' -service
- '%ProgramFiles(x86)%\eickmann computer\fernwartung\winvnc.exe' -service_run
- '%ProgramFiles(x86)%\eickmann computer\fernwartung\vncscaism.exe'
- '%ProgramFiles(x86)%\eickmann computer\fernwartung\vncscai.exe'
- '%WINDIR%\syswow64\sc.exe' CREATE "UVNC_Service" BINPATH= "\"%ProgramFiles(x86)%\Eickmann Computer\Fernwartung\winvnc.exe\" -service" start= auto' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' DELETE "UVNC_EICKMANN_TEMP"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' CREATE "UVNC_Service" BINPATH= "\"%ProgramFiles(x86)%\Eickmann Computer\Fernwartung\winvnc.exe\" -service" start= auto
- '%WINDIR%\syswow64\sc.exe' DELETE "UVNC_EICKMANN_TEMP"
