Trojan.Siggen20.61251

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\rhpstartupdownloader

Malicious functions

Modifies settings of Windows Internet Explorer

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1001' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2700' = '00000003'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2600' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2402' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2401' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2400' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2301' = '00000003'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2300' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2201' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2200' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2106' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2105' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2104' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2103' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2102' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2101' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2001' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2004' = '00000000'
[HKCU\Wow6432Node\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2107' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2108' = '00000003'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2704' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '270D' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '270C' = '00000003'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '160B' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '270B' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2302' = '00000003'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '140A' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2703' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2702' = '00000003'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2701' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1812' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2709' = '00000003'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2708' = '00000003'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2100' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2007' = '00002710'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2005' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1601' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1408' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1407' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1405' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1402' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1400' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120B' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120A' = '00000003'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1208' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1207' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1206' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1004' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1409' = '00000003'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1604' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1C00' = '00007530'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1605' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A06' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A05' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A04' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A03' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A02' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A00' = '00010000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1809' = '00000003'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1804' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1803' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1802' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '160A' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000001'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1608' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1607' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1606' = '00000000'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2000' = '00000000'
[HKCU\Wow6432Node\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1409' = '00000003'

Modifies file system

Creates the following files

%HOMEPATH%\documents\latest.exe
%TEMP%\rarsfx1\lang\ru-ru\setupdownloader.dict
%TEMP%\rarsfx1\lang\ro-ro\setupdownloader.dict
%TEMP%\rarsfx1\lang\pt-br\setupdownloader.dict
%TEMP%\rarsfx1\lang\pl-pl\setupdownloader.dict
%TEMP%\rarsfx1\lang\nl-nl\setupdownloader.dict
%TEMP%\rarsfx1\lang\ko-kr\setupdownloader.dict
%TEMP%\rarsfx1\lang\ja-jp\setupdownloader.dict
%TEMP%\rarsfx1\lang\it-it\setupdownloader.dict
%TEMP%\rarsfx1\lang\fr-fr\setupdownloader.dict
%TEMP%\rarsfx1\lang\es-es\setupdownloader.dict
%TEMP%\rarsfx1\lang\en-us\setupdownloader.dict
%TEMP%\rarsfx1\lang\tr-tr\setupdownloader.dict
%TEMP%\rarsfx1\lang\de-de\setupdownloader.dict
%TEMP%\rarsfx1\kit.cat
%TEMP%\bdtempdir01\x64\bdch.dll
%TEMP%\bdtempdir01\x64\kit.cat
%TEMP%\rarsfx0\tmp.txt
%TEMP%\bdtempdir01\data.xml
%TEMP%\bdtempdir01\kit.cat
%TEMP%\bdtempdir01\latest.dat
C:\rhpsupport\tools\wi-fi-rhpwifi.xml
C:\rhpsupport\hosts.txt
%TEMP%\bdtempdir01\installer.xml
%ALLUSERSPROFILE%\bdkitinstaller\[7.8.3.261].{297a31b5-602b-4d5b-0750-91cf51007ea2}.setupdownloader.0.bin
%TEMP%\rarsfx1\lang\cs-cz\setupdownloader.dict
%TEMP%\rarsfx1\skin\img\status-green.svg
%TEMP%\rarsfx1\bdnc.client_id
%TEMP%\rarsfx1\lang\zh-tw\setupdownloader.dict
%TEMP%\rarsfx1\skin\img\logo-setupdownloader.svg
%TEMP%\rarsfx1\languagemanager.dll
%TEMP%\rarsfx1\wslib.dll
%TEMP%\rarsfx1\skin\styles\style.css
%TEMP%\rarsfx1\skin\setup_downloader.html
%TEMP%\rarsfx1\skin\scripts\popup.tis
%TEMP%\rarsfx1\skin\scripts\movable.tis
%TEMP%\rarsfx1\skin\scripts\dict.tis
%TEMP%\rarsfx1\skin\popup.html
%TEMP%\rarsfx1\skin\img\status-red.svg
%TEMP%\rarsfx1\skin\img\status-question.svg
%ALLUSERSPROFILE%\bdkitinstaller\[7.8.3.261].{297a31b5-602b-4d5b-0750-91cf51007ea2}.setupdownloader.988.bin
%TEMP%\rarsfx1\skin\img\status-info.svg
%TEMP%\rarsfx1\skin\img\progress-bg.png
%TEMP%\rarsfx1\skin\img\minimize-installer.svg
%TEMP%\rarsfx1\skin\img\close.svg
%TEMP%\rarsfx1\skin\img\close-installer.svg
%TEMP%\rarsfx1\skin\fonts\montserrat-regular.ttf
%TEMP%\rarsfx1\skin\fonts\montserrat-medium.ttf
%TEMP%\rarsfx1\skin\fonts\montserrat-light.ttf
%TEMP%\rarsfx1\skin\fonts\montserrat-bold.ttf
%TEMP%\rarsfx1\skin\bdicon.ico
%TEMP%\rarsfx1\setupdownloader.exe
%TEMP%\rarsfx1\sciter.dll
%TEMP%\rarsfx1\lang\vi-vn\setupdownloader.dict
%TEMP%\rarsfx1\lang\zh-cn\setupdownloader.dict
%TEMP%\rarsfx0\setupdownloader.xml
%TEMP%\rarsfx0\lang\vi-vn\setupdownloader.dict
%TEMP%\rarsfx0\lang\ro-ro\setupdownloader.dict
%TEMP%\rarsfx0\lang\pt-br\setupdownloader.dict
%TEMP%\rarsfx0\lang\pl-pl\setupdownloader.dict
%TEMP%\rarsfx0\lang\nl-nl\setupdownloader.dict
%TEMP%\rarsfx0\lang\ko-kr\setupdownloader.dict
%TEMP%\rarsfx0\lang\ja-jp\setupdownloader.dict
%TEMP%\rarsfx0\lang\it-it\setupdownloader.dict
%TEMP%\rarsfx0\lang\fr-fr\setupdownloader.dict
%TEMP%\rarsfx0\lang\es-es\setupdownloader.dict
%TEMP%\rarsfx0\lang\en-us\setupdownloader.dict
%TEMP%\rarsfx0\lang\de-de\setupdownloader.dict
%TEMP%\rarsfx0\lang\ru-ru\setupdownloader.dict
%TEMP%\rarsfx0\lang\cs-cz\setupdownloader.dict
C:\rhpsupport\latest.exe
nul
C:\rhpsupport\tools\best_downloaderwrapper.msi
C:\rhpsupport\startup-downloader.exe
C:\rhpsupport\tools\nircmd.exe
C:\rhpsupport\tools\nircmd-32.exe
C:\rhpsupport\tools\nircmd-64.exe
%HOMEPATH%\documents\rhp-fall-2018-update.exe
%HOMEPATH%\documents\wide.bmp
%HOMEPATH%\desktop\snipping tool.lnk
%HOMEPATH%\desktop\rhp intranet.lnk
%TEMP%\rarsfx0\kit.cat
%TEMP%\rarsfx0\skin\img\progress-bg.png
%TEMP%\rarsfx0\skin\img\logo-setupdownloader.svg
%TEMP%\rarsfx0\lang\zh-cn\setupdownloader.dict
%TEMP%\rarsfx0\languagemanager.dll
%TEMP%\rarsfx0\wslib.dll
%TEMP%\rarsfx0\skin\styles\style.css
%TEMP%\rarsfx0\skin\setup_downloader.html
%TEMP%\rarsfx0\skin\scripts\popup.tis
%TEMP%\rarsfx0\skin\scripts\movable.tis
%TEMP%\rarsfx0\skin\scripts\dict.tis
%TEMP%\rarsfx0\skin\popup.html
%TEMP%\rarsfx0\skin\img\status-red.svg
%TEMP%\rarsfx0\skin\img\status-question.svg
%TEMP%\rarsfx0\skin\img\status-info.svg
%TEMP%\rarsfx0\bdnc.client_id
%TEMP%\rarsfx0\skin\img\status-green.svg
%TEMP%\rarsfx0\skin\img\minimize-installer.svg
%TEMP%\rarsfx0\skin\img\close.svg
%TEMP%\rarsfx0\skin\img\close-installer.svg
%TEMP%\rarsfx0\skin\fonts\montserrat-regular.ttf
%TEMP%\rarsfx0\skin\fonts\montserrat-medium.ttf
%TEMP%\rarsfx0\skin\fonts\montserrat-light.ttf
%TEMP%\rarsfx0\skin\fonts\montserrat-bold.ttf
%TEMP%\rarsfx0\skin\bdicon.ico
%TEMP%\rarsfx0\setupdownloader.exe
%TEMP%\rarsfx0\sciter.dll
%TEMP%\rarsfx0\lang\zh-tw\setupdownloader.dict
%TEMP%\rarsfx0\lang\tr-tr\setupdownloader.dict
%TEMP%\rarsfx1\setupdownloader.xml

Deletes the following files

%HOMEPATH%\documents\latest.exe
%TEMP%\rarsfx1\lang\pt-br\setupdownloader.dict
%TEMP%\rarsfx1\lang\pl-pl\setupdownloader.dict
%TEMP%\rarsfx1\lang\nl-nl\setupdownloader.dict
%TEMP%\rarsfx1\lang\ko-kr\setupdownloader.dict
%TEMP%\rarsfx1\lang\ja-jp\setupdownloader.dict
%TEMP%\rarsfx1\lang\it-it\setupdownloader.dict
%TEMP%\rarsfx1\lang\fr-fr\setupdownloader.dict
%TEMP%\rarsfx1\lang\es-es\setupdownloader.dict
%TEMP%\rarsfx1\lang\en-us\setupdownloader.dict
%TEMP%\rarsfx1\lang\de-de\setupdownloader.dict
%TEMP%\rarsfx1\lang\cs-cz\setupdownloader.dict
%TEMP%\rarsfx1\wslib.dll
%TEMP%\rarsfx1\setupdownloader.xml
%TEMP%\rarsfx1\setupdownloader.exe
%TEMP%\rarsfx1\sciter.dll
%TEMP%\rarsfx1\languagemanager.dll
%TEMP%\rarsfx1\kit.cat
%TEMP%\rarsfx1\bdnc.client_id
%TEMP%\rarsfx0\skin\styles\style.css
%TEMP%\rarsfx0\skin\scripts\popup.tis
%TEMP%\rarsfx0\skin\scripts\movable.tis
%TEMP%\rarsfx0\skin\img\status-red.svg
%TEMP%\rarsfx0\skin\scripts\dict.tis
%TEMP%\rarsfx1\lang\ro-ro\setupdownloader.dict
%TEMP%\rarsfx1\lang\ru-ru\setupdownloader.dict
%TEMP%\rarsfx1\skin\scripts\movable.tis
%TEMP%\rarsfx1\skin\scripts\dict.tis
%TEMP%\rarsfx1\skin\img\status-red.svg
%TEMP%\rarsfx1\skin\img\status-question.svg
%TEMP%\rarsfx1\skin\img\status-info.svg
%TEMP%\rarsfx1\skin\img\status-green.svg
%TEMP%\rarsfx1\skin\img\progress-bg.png
%TEMP%\rarsfx1\skin\img\minimize-installer.svg
%TEMP%\rarsfx1\skin\img\logo-setupdownloader.svg
%TEMP%\rarsfx1\skin\img\close.svg
%TEMP%\rarsfx1\skin\fonts\montserrat-regular.ttf
%TEMP%\rarsfx0\skin\bdicon.ico
%TEMP%\rarsfx1\skin\fonts\montserrat-medium.ttf
%TEMP%\rarsfx1\skin\fonts\montserrat-light.ttf
%TEMP%\rarsfx1\skin\fonts\montserrat-bold.ttf
%TEMP%\rarsfx1\skin\setup_downloader.html
%TEMP%\rarsfx1\skin\popup.html
%TEMP%\rarsfx1\skin\bdicon.ico
%TEMP%\rarsfx1\lang\zh-tw\setupdownloader.dict
%TEMP%\rarsfx1\lang\zh-cn\setupdownloader.dict
%TEMP%\rarsfx1\lang\vi-vn\setupdownloader.dict
%TEMP%\rarsfx1\lang\tr-tr\setupdownloader.dict
%TEMP%\rarsfx0\skin\img\status-question.svg
%TEMP%\rarsfx0\skin\img\status-info.svg
%TEMP%\rarsfx0\skin\img\status-green.svg
%TEMP%\rarsfx0\lang\de-de\setupdownloader.dict
%TEMP%\rarsfx0\lang\cs-cz\setupdownloader.dict
%TEMP%\rarsfx0\wslib.dll
%TEMP%\rarsfx0\setupdownloader.xml
%TEMP%\rarsfx0\setupdownloader.exe
%TEMP%\rarsfx0\sciter.dll
%TEMP%\rarsfx0\languagemanager.dll
%TEMP%\rarsfx0\kit.cat
%TEMP%\rarsfx0\bdnc.client_id
%ALLUSERSPROFILE%\bdkitinstaller\[7.8.3.261].{297a31b5-602b-4d5b-0750-91cf51007ea2}.setupdownloader.0.bin
%ALLUSERSPROFILE%\bdkitinstaller\[7.8.3.261].{297a31b5-602b-4d5b-0750-91cf51007ea2}.setupdownloader.988.bin
%TEMP%\bdtempdir01\x64\kit.cat1686369121
%TEMP%\bdtempdir01\x64\bdch.dll1686369121
%TEMP%\bdtempdir01\kit.cat1686369121
%TEMP%\bdtempdir01\installer.xml1686369121
%TEMP%\bdtempdir01\data.xml1686369121
%TEMP%\rarsfx0\tmp.txt
C:\rhpsupport\latest.exe
%TEMP%\bdtempdir01\latest.dat
C:\rhpsupport\tools\wi-fi-rhpwifi.xml
%TEMP%\rarsfx0\lang\es-es\setupdownloader.dict
%TEMP%\rarsfx0\lang\fr-fr\setupdownloader.dict
%TEMP%\rarsfx0\lang\en-us\setupdownloader.dict
%TEMP%\rarsfx0\lang\it-it\setupdownloader.dict
%TEMP%\rarsfx0\skin\img\progress-bg.png
%TEMP%\rarsfx0\lang\ja-jp\setupdownloader.dict
%TEMP%\rarsfx0\skin\img\minimize-installer.svg
%TEMP%\rarsfx0\skin\img\logo-setupdownloader.svg
%TEMP%\rarsfx0\skin\img\close.svg
%TEMP%\rarsfx0\skin\img\close-installer.svg
%TEMP%\rarsfx0\skin\fonts\montserrat-regular.ttf
%TEMP%\rarsfx0\skin\fonts\montserrat-medium.ttf
%TEMP%\rarsfx0\skin\fonts\montserrat-light.ttf
%TEMP%\rarsfx0\skin\fonts\montserrat-bold.ttf
%TEMP%\rarsfx0\skin\setup_downloader.html
%TEMP%\rarsfx1\skin\img\close-installer.svg
%TEMP%\rarsfx1\skin\scripts\popup.tis
%TEMP%\rarsfx0\lang\zh-tw\setupdownloader.dict
%TEMP%\rarsfx0\lang\zh-cn\setupdownloader.dict
%TEMP%\rarsfx0\lang\vi-vn\setupdownloader.dict
%TEMP%\rarsfx0\lang\tr-tr\setupdownloader.dict
%TEMP%\rarsfx0\lang\ru-ru\setupdownloader.dict
%TEMP%\rarsfx0\lang\ro-ro\setupdownloader.dict
%TEMP%\rarsfx0\lang\pt-br\setupdownloader.dict
%TEMP%\rarsfx0\lang\pl-pl\setupdownloader.dict
%TEMP%\rarsfx0\lang\nl-nl\setupdownloader.dict
%TEMP%\rarsfx0\lang\ko-kr\setupdownloader.dict
%TEMP%\rarsfx0\skin\popup.html
%TEMP%\rarsfx1\skin\styles\style.css

Moves the following files

from %TEMP%\bdtempdir01\data.xml to %TEMP%\bdtempdir01\data.xml1686369121
from %TEMP%\bdtempdir01\installer.xml to %TEMP%\bdtempdir01\installer.xml1686369121
from %TEMP%\bdtempdir01\kit.cat to %TEMP%\bdtempdir01\kit.cat1686369121
from %TEMP%\bdtempdir01\x64\bdch.dll to %TEMP%\bdtempdir01\x64\bdch.dll1686369121
from %TEMP%\bdtempdir01\x64\kit.cat to %TEMP%\bdtempdir01\x64\kit.cat1686369121

Modifies the following files

%LOCALAPPDATA%\microsoft\windows\usrclass.dat.log1
%LOCALAPPDATA%\microsoft\windows\usrclass.dat

Substitutes the following files

%TEMP%\bdtempdir01\latest.dat

Modifies the HOSTS file.

Network activity

Connects to

'pu####.#hp-properties.com':80
'localhost':49253
'localhost':49250
'localhost':49247
'localhost':49244
'localhost':49241
'localhost':49238
'localhost':49235
'localhost':49232
'localhost':49229
'localhost':49226
'localhost':49223
'localhost':49220
'localhost':49217
'localhost':49212
'localhost':49208
'cl###.####ityzone.bitdefender.com':443
'localhost':49204
'cl#######.#ravityzone.bitdefender.com':443
'localhost':49201
'localhost':49256
'localhost':49259

TCP

HTTP GET requests

http://pu####.#hp-properties.com/corporate/support/packages/latest.exe
http://pu####.#hp-properties.com/corporate/support/packages/RHP-Fall-2018-Update.exe
http://pu####.#hp-properties.com/corporate/support/packages/Startup-Downloader.exe
http://pu####.#hp-properties.com/corporate/support/packages/BEST_downloaderWrapper.msi
http://pu####.#hp-properties.com/corporate/support/packages/hosts.txt

Other

'34.##9.100.209':443
'localhost':49254
'localhost':49251
'localhost':49248
'localhost':49245
'localhost':49242
'localhost':49239
'localhost':49236
'localhost':49233
'localhost':49230
'localhost':49227
'localhost':49224
'localhost':49221
'localhost':49218
'localhost':49213
'localhost':49209
'cl###.####ityzone.bitdefender.com':443
'localhost':49205
'cl#######.#ravityzone.bitdefender.com':443
'localhost':49202
'localhost':49257
'localhost':49260

UDP

DNS ASK pu####.#hp-properties.com
DNS ASK cl#######.#ravityzone.bitdefender.com
DNS ASK cl###.####ityzone.bitdefender.com

Miscellaneous

Searches for the following windows

ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%HOMEPATH%\documents\latest.exe'
'%HOMEPATH%\documents\rhp-fall-2018-update.exe'
'C:\rhpsupport\tools\nircmd.exe' elevate cmd /c schtasks.exe /create /tn "RHPStartupDownloader" /tr "C:\RHPSupport\Startup-Downloader.exe" /rl HIGHEST /sc ONLOGON /DELAY 0000:30 /F /RU "BuiltIn\Users"
'C:\rhpsupport\tools\nircmd.exe' elevate cmd /c msiexec /i c:\rhpsupport\tools\BEST_downloaderWrapper.msi /qn GZ_PACKAGE_ID=aHR0cHM6Ly9jbG91ZC1lY3MuZ3Jhdml0eXpvbmUuYml0ZGVmZW5kZXIuY29tL1BhY2thZ2VzL0JTVFdJTi8wL2dJYTVHMy9pbnN0YW...
'C:\rhpsupport\latest.exe'
'%WINDIR%\installer\msi2bd5.tmp' /bdparams /silent /sourceUrlEnc="aHR0cHM6Ly9jbG91ZC1lY3MuZ3Jhdml0eXpvbmUuYml0ZGVmZW5kZXIuY29tL1BhY2thZ2VzL0JTVFdJTi8wL2dJYTVHMy9pbnN0YWxsZXIueG1sP2xhbmc9ZW4tVVM=" /runParams="/silent rebootIfNe...
'%TEMP%\rarsfx0\setupdownloader.exe'
'%WINDIR%\installer\msic112.tmp' /bdparams /silent /sourceUrlEnc="aHR0cHM6Ly9jbG91ZC1lY3MuZ3Jhdml0eXpvbmUuYml0ZGVmZW5kZXIuY29tL1BhY2thZ2VzL0JTVFdJTi8wL2dJYTVHMy9pbnN0YWxsZXIueG1sP2xhbmc9ZW4tVVM=" /runParams="/silent rebootIfNe...
'%TEMP%\rarsfx1\setupdownloader.exe'
'<SYSTEM32>\cmd.exe' /c "netsh wlan add profile filename="C:\RHPSupport\Tools\Wi-Fi-rhpwifi.xml" user=all"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "netsh wlan set profileparameter name="rhpwifi" ConnectionMode="auto""' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ping -n 3 localhost>nul & Del "%HOMEPATH%\Documents\latest.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ipconfig /flushdns>nul' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ping -n 3 localhost>nul & Del "C:\RHPSupport\latest.exe"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c "netsh wlan add profile filename="C:\RHPSupport\Tools\Wi-Fi-rhpwifi.xml" user=all"
'<SYSTEM32>\netsh.exe' wlan add profile filename="C:\RHPSupport\Tools\Wi-Fi-rhpwifi.xml" user=all
'<SYSTEM32>\cmd.exe' /c "netsh wlan set profileparameter name="rhpwifi" ConnectionMode="auto""
'<SYSTEM32>\netsh.exe' wlan set profileparameter name="rhpwifi" ConnectionMode="auto"
'<SYSTEM32>\cmd.exe' /c schtasks.exe /create /tn "RHPStartupDownloader" /tr "C:\RHPSupport\Startup-Downloader.exe" /rl HIGHEST /sc ONLOGON /DELAY 0000:30 /F /RU "BuiltIn\Users"
'<SYSTEM32>\schtasks.exe' /create /tn "RHPStartupDownloader" /tr "C:\RHPSupport\Startup-Downloader.exe" /rl HIGHEST /sc ONLOGON /DELAY 0000:30 /F /RU "BuiltIn\Users"
'<SYSTEM32>\cmd.exe' /c msiexec /i c:\rhpsupport\tools\BEST_downloaderWrapper.msi /qn GZ_PACKAGE_ID=aHR0cHM6Ly9jbG91ZC1lY3MuZ3Jhdml0eXpvbmUuYml0ZGVmZW5kZXIuY29tL1BhY2thZ2VzL0JTVFdJTi8wL2dJYTVHMy9pbnN0YWxsZXIueG1sP2...
'<SYSTEM32>\msiexec.exe' /i c:\rhpsupport\tools\BEST_downloaderWrapper.msi /qn GZ_PACKAGE_ID=aHR0cHM6Ly9jbG91ZC1lY3MuZ3Jhdml0eXpvbmUuYml0ZGVmZW5kZXIuY29tL1BhY2thZ2VzL0JTVFdJTi8wL2dJYTVHMy9pbnN0YWxsZXIueG1sP2xhbmc9ZW4tV...
'<SYSTEM32>\cmd.exe' /c ping -n 3 localhost>nul & Del "%HOMEPATH%\Documents\latest.exe"
'<SYSTEM32>\ping.exe' -n 3 localhost
'<SYSTEM32>\cmd.exe' /c ipconfig /flushdns>nul
'<SYSTEM32>\ipconfig.exe' /flushdns
'<SYSTEM32>\cmd.exe' /c ping -n 3 localhost>nul & Del "C:\RHPSupport\latest.exe"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial