Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im PccNT.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im tmlisten.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im ntrtscan.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TMBMSRV.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TmCCSF.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im PccNTMon.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im OfcPfwSvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TmProxy.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im ntrmv.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im pccntupd.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TmPfw.exe
- '%WINDIR%\syswow64\taskkill.exe' /im explorer.exe /f
Modifies file system
Creates the following files
- C:\temp\ofccln.ini
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im PccNT.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%ProgramFiles(x86)%\Trend Micro"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%ProgramFiles%\Asiainfo Security"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%ProgramFiles(x86)%\Asiainfo Security"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files\Trend Micro\BM"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files (x86)\Trend Micro\BM"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files\Trend Micro\OfficeScan Client"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files (x86)\Trend Micro\OfficeScan Client"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im TmPfw.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files\Asiainfo Security\BM"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files\Asiainfo Security\OfficeScan Client"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "d:\Program Files\Trend Micro"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "d:\Program Files (x86)\Trend Micro"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "d:\Program Files\Asiainfo Security"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "d:\Program Files (x86)\Asiainfo Security"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "C:\Documents and Settings\All Users\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Ç÷ÊƿƼ¼·À¶¾Ç½ÍøÂç°æ¿Í»§¶Ë"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Ç÷ÊƿƼ¼·À¶¾Ç½ÍøÂç°æ¿Í»§¶Ë"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles%\Asiainfo Security\OfficeScan Client"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%ProgramFiles%\Trend Micro"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles(x86)%\Asiainfo Security\OfficeScan Client"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles%\Asiainfo Security\BM"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles(x86)%\Trend Micro\OfficeScan Client"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im ntrtscan.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im TMBMSRV.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im TmCCSF.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im PccNTMon.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im OfcPfwSvc.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im TmProxy.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im ntrmv.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %APPDATA%\Microsoft\Windows\Start Menu\Programs\Ç÷ÊƿƼ¼·À¶¾Ç½ÍøÂç°æ¿Í»§¶Ë' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files (x86)\Asiainfo Security\OfficeScan Client"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im pccntupd.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete ntrtscan' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete tmlisten' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete tmccsf' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete tmbmsrv' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles%\Trend Micro\BM"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles(x86)%\Trend Micro\BM"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles%\Trend Micro\OfficeScan Client"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im tmlisten.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete TmPfw' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im explorer.exe /f' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im PccNT.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles%\Asiainfo Security\BM"
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles(x86)%\Asiainfo Security\OfficeScan Client"
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles%\Asiainfo Security\OfficeScan Client"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%ProgramFiles%\Trend Micro"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%ProgramFiles(x86)%\Trend Micro"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%ProgramFiles%\Asiainfo Security"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%ProgramFiles(x86)%\Asiainfo Security"
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files\Trend Micro\BM"
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files (x86)\Trend Micro\BM"
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files (x86)\Trend Micro\OfficeScan Client"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %APPDATA%\Microsoft\Windows\Start Menu\Programs\Ç÷ÊƿƼ¼·À¶¾Ç½ÍøÂç°æ¿Í»§¶Ë
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files\Asiainfo Security\BM"
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files (x86)\Asiainfo Security\OfficeScan Client"
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files\Asiainfo Security\OfficeScan Client"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "d:\Program Files\Trend Micro"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "d:\Program Files (x86)\Trend Micro"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "d:\Program Files\Asiainfo Security"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "d:\Program Files (x86)\Asiainfo Security"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "C:\Documents and Settings\All Users\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Ç÷ÊƿƼ¼·À¶¾Ç½ÍøÂç°æ¿Í»§¶Ë"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Ç÷ÊƿƼ¼·À¶¾Ç½ÍøÂç°æ¿Í»§¶Ë"
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles(x86)%\Trend Micro\OfficeScan Client"
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "d:\Program Files\Trend Micro\OfficeScan Client"
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles%\Trend Micro\OfficeScan Client"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im TmPfw.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im tmlisten.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im ntrtscan.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im TMBMSRV.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im TmCCSF.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im PccNTMon.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im OfcPfwSvc.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im TmProxy.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im ntrmv.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im pccntupd.exe
- '%WINDIR%\syswow64\cmd.exe' /c sc delete TmPfw
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles%\Trend Micro\BM"
- '%WINDIR%\syswow64\sc.exe' delete TmPfw
- '%WINDIR%\syswow64\cmd.exe' /c sc delete ntrtscan
- '%WINDIR%\syswow64\sc.exe' delete ntrtscan
- '%WINDIR%\syswow64\cmd.exe' /c sc delete tmlisten
- '%WINDIR%\syswow64\sc.exe' delete tmlisten
- '%WINDIR%\syswow64\cmd.exe' /c sc delete tmccsf
- '%WINDIR%\syswow64\sc.exe' delete tmccsf
- '%WINDIR%\syswow64\cmd.exe' /c sc delete tmbmsrv
- '%WINDIR%\syswow64\sc.exe' delete tmbmsrv
- '%WINDIR%\syswow64\cmd.exe' /c del /q /f "%ProgramFiles(x86)%\Trend Micro\BM"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im explorer.exe /f
