Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'terwilligerincluded' = '"%ProgramFiles%\abuses\minh.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'includedterwilliger' = '"%ProgramFiles%\abuses\minh.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'terwilliger' = '"%ProgramFiles%\Cabanas\conversationally.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'includedincluded' = '"%ProgramFiles%\Scrawny\conversationally.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iditarod' = '"%ProgramFiles%\Cabanas\conversationally.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'yack' = '"%ProgramFiles%\mapper\yack.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'terwilligerterwilliger' = '"%ProgramFiles%\Scrawny\conversationally.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'remowoefully' = '"%ProgramFiles%\abuses\minh.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'woefully' = '"%ProgramFiles%\Cabanas\conversationally.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'remo' = '"%ProgramFiles%\Cabanas\conversationally.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'woefullyremo' = '"%ProgramFiles%\abuses\minh.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'included' = '"%ProgramFiles%\Cabanas\conversationally.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'woefullywoefully' = '"%ProgramFiles%\Scrawny\conversationally.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'remoremo' = '"%ProgramFiles%\Scrawny\conversationally.exe"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\monologuemonologue.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\monologue.lnk
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /im chrome.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\2-or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[1].htm
- %TEMP%\nsxA.tmp\nsB.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[1].htm
- %TEMP%\nsiD.tmp\ShellLink.dll
- %TEMP%\nsxA.tmp\nsExec.dll
- %TEMP%\nsr7.tmp\AccessControl.dll
- %ProgramFiles%\stalks\stalks.exe
- %WINDIR%\chlorpromazine.exe
- %ProgramFiles%\mapper\yack.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[1].htm
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[1].htm
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[4].htm
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[2].htm
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[2].htm
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[3].htm
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[3].htm
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[2].htm
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[2].htm
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin[1].htm
- %TEMP%\nso2.tmp\Microsoft.Win32.TaskScheduler.dll
- %TEMP%\nso2.tmp\NMviticulture.exe
- %ProgramFiles%\Cabanas\Cabanas.exe
- %TEMP%\nso2.tmp\118061.exe
- %TEMP%\nso2.tmp\122748.exe
- %TEMP%\nso2.tmp\47915.exe
- %TEMP%\nso2.tmp\20731.exe
- %TEMP%\nso2.tmp\109654.exe
- %TEMP%\nso2.tmp\67237.exe
- %ProgramFiles%\Cabanas\conversationally.dll
- %ProgramFiles%\Scrawny\conversationally.exe
- <LS_APPDATA>\minh.exe
- %TEMP%\nsj5.tmp\SimpleFC.dll
- %ProgramFiles%\Scrawny\minh.exe
- <LS_APPDATA>\conversationally.exe
- %ProgramFiles%\abuses\abuses.exe
- %ProgramFiles%\Cabanas\conversationally.exe
- %ProgramFiles%\abuses\minh.exe
- %ProgramFiles%\abuses\minh.dll
Deletes the following files:
- %TEMP%\nsiD.tmp\ShellLink.dll
- %TEMP%\nsr7.tmp\AccessControl.dll
- %TEMP%\nsj5.tmp\SimpleFC.dll
Network activity:
Connects to:
- 'fa####sexcretory.pw':80
- 'localhost':1048
- 'localhost':1040
- 'localhost':1038
- 'localhost':1039
TCP:
HTTP GET requests:
- http://www.fa####sexcretory.pw/or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin.htm?03################## via fa####sexcretory.pw
- http://www.fa####sexcretory.pw/2-or2ldin0ldin1ldin8ldin0hGf2hGf1or5orldin.htm?03################## via fa####sexcretory.pw
UDP:
- DNS ASK www.fa####sexcretory.pw
Miscellaneous:
Searches for the following windows:
- ClassName: 'Chrome_WidgetWin_0' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%TEMP%\nso2.tmp\NMviticulture.exe' "%ProgramFiles%\stalks\stalks.exe" "symmetrical"
- '%TEMP%\nso2.tmp\118061.exe'
- '%TEMP%\nso2.tmp\NMviticulture.exe' "%ProgramFiles%\Scrawny\conversationally.exe" "yuichi_piggly"
- '%TEMP%\nso2.tmp\NMviticulture.exe' "%ProgramFiles%\Scrawny\minh.exe" "compression cleo"
- '%TEMP%\nso2.tmp\109654.exe'
- '%TEMP%\nsxA.tmp\nsB.tmp' taskkill /im chrome.exe
- '%ProgramFiles%\mapper\yack.exe'
- '%TEMP%\nso2.tmp\67237.exe'
- '%ProgramFiles%\Scrawny\minh.exe'
- '%TEMP%\nso2.tmp\122748.exe'
- '%ProgramFiles%\Cabanas\conversationally.exe'
- '%TEMP%\nso2.tmp\NMviticulture.exe' "%ProgramFiles%\Cabanas\conversationally.exe" "childcare"
- '%TEMP%\nso2.tmp\NMviticulture.exe' "%ProgramFiles%\abuses\minh.exe" "alltel-moisture"
- '%TEMP%\nso2.tmp\NMviticulture.exe' "<LS_APPDATA>\minh.exe" "mashantucket_hoogovens"
- '%ProgramFiles%\Scrawny\conversationally.exe'
- '%TEMP%\nso2.tmp\47915.exe'
- '%TEMP%\nso2.tmp\NMviticulture.exe' "<LS_APPDATA>\conversationally.exe" "navajo numbers propagating"
