Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\BurnAwareOpen\shell\open\command] '' = '"%ProgramFiles%\BurnAware Premium\burnaware.exe"'
- [<HKLM>\SOFTWARE\Classes\iso-file\Shell\Open\Command] '' = '"%ProgramFiles%\BurnAware Premium\unpackiso.exe" "%1"'
Malicious functions:
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
- %ProgramFiles%\BurnAware Premium\is-0FGPD.tmp
- %ProgramFiles%\BurnAware Premium\is-4AQ70.tmp
- %ProgramFiles%\BurnAware Premium\is-5JCNL.tmp
- %ProgramFiles%\BurnAware Premium\is-PIJV0.tmp
- %ProgramFiles%\BurnAware Premium\is-AENQ5.tmp
- %ProgramFiles%\BurnAware Premium\is-O13QK.tmp
- %ProgramFiles%\BurnAware Premium\is-O47GS.tmp
- %ProgramFiles%\BurnAware Premium\is-UFMCJ.tmp
- %ProgramFiles%\BurnAware Premium\is-AJOCC.tmp
- %ProgramFiles%\BurnAware Premium\is-ROKCM.tmp
- %ProgramFiles%\BurnAware Premium\is-OE0GC.tmp
- %ALLUSERSPROFILE%\Desktop\BurnAware Premium.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Premium\Uninstall BurnAware Premium.lnk
- %ProgramFiles%\BurnAware Premium\unins000.dat
- %TEMP%\45DAD.dmp
- %TEMP%\dw.log
- %ProgramFiles%\BurnAware Premium\is-HFD71.tmp
- %ProgramFiles%\BurnAware Premium\is-0065K.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Premium\BurnAware Premium.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Premium\BurnAware Premium on the Web.url
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Premium\Help.lnk
- %ProgramFiles%\BurnAware Premium\is-070F0.tmp
- %ProgramFiles%\BurnAware Premium\is-SJVN9.tmp
- %ProgramFiles%\BurnAware Premium\is-TSBLS.tmp
- %ProgramFiles%\BurnAware Premium\is-3CTEJ.tmp
- %ProgramFiles%\BurnAware Premium\is-2MK80.tmp
- %ProgramFiles%\BurnAware Premium\is-KFPKF.tmp
- %TEMP%\dzphp4278.exe
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\is-MAICI.tmp\dzphp4278.tmp
- %TEMP%\update.exe
- %ProgramFiles%\BurnAware Premium\is-DH5OU.tmp
- %ProgramFiles%\BurnAware Premium\is-4IECQ.tmp
- %ProgramFiles%\BurnAware Premium\is-T2FQK.tmp
- %ProgramFiles%\BurnAware Premium\is-QQ0F0.tmp
- %ProgramFiles%\BurnAware Premium\is-UD9V8.tmp
- %ProgramFiles%\BurnAware Premium\is-I60U5.tmp
- %ProgramFiles%\BurnAware Premium\is-4V1RU.tmp
- %ProgramFiles%\BurnAware Premium\is-673PT.tmp
- %ProgramFiles%\BurnAware Premium\is-8F7OD.tmp
- %ProgramFiles%\BurnAware Premium\is-FRGPR.tmp
- %ProgramFiles%\BurnAware Premium\is-GKR1U.tmp
Deletes the following files:
- %TEMP%\is-MAICI.tmp\dzphp4278.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
Moves the following files:
- from %ProgramFiles%\BurnAware Premium\is-UFMCJ.tmp to %ProgramFiles%\BurnAware Premium\bamedenclib.dll
- from %ProgramFiles%\BurnAware Premium\is-ROKCM.tmp to %ProgramFiles%\BurnAware Premium\baplayer.dll
- from %ProgramFiles%\BurnAware Premium\is-AJOCC.tmp to %ProgramFiles%\BurnAware Premium\bass.dll
- from %ProgramFiles%\BurnAware Premium\is-O13QK.tmp to %ProgramFiles%\BurnAware Premium\bamainlib.dll
- from %ProgramFiles%\BurnAware Premium\is-UD9V8.tmp to %ProgramFiles%\BurnAware Premium\UnpackISO.exe
- from %ProgramFiles%\BurnAware Premium\is-070F0.tmp to %ProgramFiles%\BurnAware Premium\burnaware.chm
- from %ProgramFiles%\BurnAware Premium\is-O47GS.tmp to %ProgramFiles%\BurnAware Premium\badecx.dll
- from %ProgramFiles%\BurnAware Premium\is-4AQ70.tmp to %ProgramFiles%\BurnAware Premium\bassenc.dll
- from %ProgramFiles%\BurnAware Premium\is-OE0GC.tmp to %ProgramFiles%\BurnAware Premium\Dos622.img
- from %ProgramFiles%\BurnAware Premium\is-0065K.tmp to %ProgramFiles%\BurnAware Premium\ba11premium.dll
- from %ProgramFiles%\BurnAware Premium\is-HFD71.tmp to %ProgramFiles%\BurnAware Premium\isofile.ico
- from %ProgramFiles%\BurnAware Premium\is-PIJV0.tmp to %ProgramFiles%\BurnAware Premium\bawmalib.dll
- from %ProgramFiles%\BurnAware Premium\is-0FGPD.tmp to %ProgramFiles%\BurnAware Premium\bassflac.dll
- from %ProgramFiles%\BurnAware Premium\is-5JCNL.tmp to %ProgramFiles%\BurnAware Premium\basswma.dll
- from %ProgramFiles%\BurnAware Premium\is-AENQ5.tmp to %ProgramFiles%\BurnAware Premium\tags.dll
- from %ProgramFiles%\BurnAware Premium\is-2MK80.tmp to %ProgramFiles%\BurnAware Premium\MediaDisc.exe
- from %ProgramFiles%\BurnAware Premium\is-DH5OU.tmp to %ProgramFiles%\BurnAware Premium\DataDisc.exe
- from %ProgramFiles%\BurnAware Premium\is-673PT.tmp to %ProgramFiles%\BurnAware Premium\DiscInfo.exe
- from %ProgramFiles%\BurnAware Premium\is-KFPKF.tmp to %ProgramFiles%\BurnAware Premium\BurnImage.exe
- from %ProgramFiles%\BurnAware Premium\is-TSBLS.tmp to %ProgramFiles%\BurnAware Premium\unins000.exe
- from %ProgramFiles%\BurnAware Premium\is-SJVN9.tmp to %ProgramFiles%\BurnAware Premium\SpanDisc.exe
- from %ProgramFiles%\BurnAware Premium\is-3CTEJ.tmp to %ProgramFiles%\BurnAware Premium\AudioCD.exe
- from %ProgramFiles%\BurnAware Premium\is-4V1RU.tmp to %ProgramFiles%\BurnAware Premium\EraseDisc.exe
- from %ProgramFiles%\BurnAware Premium\is-4IECQ.tmp to %ProgramFiles%\BurnAware Premium\VerifyDisc.exe
- from %ProgramFiles%\BurnAware Premium\is-QQ0F0.tmp to %ProgramFiles%\BurnAware Premium\AudioGrabber.exe
- from %ProgramFiles%\BurnAware Premium\is-I60U5.tmp to %ProgramFiles%\BurnAware Premium\BurnAware.exe
- from %ProgramFiles%\BurnAware Premium\is-T2FQK.tmp to %ProgramFiles%\BurnAware Premium\DataRecovery.exe
- from %ProgramFiles%\BurnAware Premium\is-8F7OD.tmp to %ProgramFiles%\BurnAware Premium\CopyImage.exe
- from %ProgramFiles%\BurnAware Premium\is-GKR1U.tmp to %ProgramFiles%\BurnAware Premium\MakeISO.exe
- from %ProgramFiles%\BurnAware Premium\is-FRGPR.tmp to %ProgramFiles%\BurnAware Premium\CopyDisc.exe
Network activity:
Connects to:
- 'bu###ware.com':80
- 'localhost':1040
- 'ip###ger.com':443
TCP:
HTTP GET requests:
- http://www.bu###ware.com/after-install.html via bu###ware.com
UDP:
- DNS ASK www.bu###ware.com
- DNS ASK ip###ger.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
Creates and executes the following:
- '%TEMP%\is-MAICI.tmp\dzphp4278.tmp' /SL5="$100E4,7405673,189952,%TEMP%\dzphp4278.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\update.exe'
- '%TEMP%\dzphp4278.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1384
- '<SYSTEM32>\cmd.exe' /c %TEMP%\dzphp4278.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '<SYSTEM32>\cmd.exe' /c %TEMP%\update.exe
