Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\windows\currentversion\run] 'RunmeAtStartup' = '%WINDIR%\p13.exe'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\DOWIRE] 'ImagePath' = '<SYSTEM32>\DOWIRE.sys'
Modifies file system
Creates the following files
- %WINDIR%\105.exe
- %WINDIR%\syswow64\r.dat
- %WINDIR%\syswow64\dowire.sys
- %WINDIR%\444.exe
- %WINDIR%\p13.exe
- %WINDIR%\syswow64\xvhost.sb
- <LS_APPDATA>\microsoft\windows\history\history.ie5\mshist012019102820191029\index.dat
Sets the 'hidden' attribute to the following files
- %WINDIR%\105.exe
- %WINDIR%\444.exe
- %WINDIR%\p13.exe
Network activity
TCP
HTTP GET requests
- http://www.cf###gzi.com/cfyingzi/down.html
- http://tj##88.cn/wz/static/fonts/iconfont.eot)%20format(%22embedded-opentype%22),%20url(../fonts/051cb86a5795435d8f1f53f716f01a27.woff)%20format(%22woff2%22),%20url(../fonts/iconfont.woff)%20fo...
- http://tj##88.cn/wz/static/picture/pic1.png
- http://tj##88.cn/wz/static/picture/1909201033.png
- http://tj##88.cn/wz/static/picture/img3.png
- http://tj##88.cn/wz/static/picture/img2.png
- http://tj##88.cn/wz/static/js/jquery-1.9.0.min.js
- http://tj##88.cn/wz/static/picture/pic3.png
- http://tj##88.cn/wz/static/picture/pic2.png
- http://tj##88.cn/wz/static/picture/user_bg.png
- http://tj##88.cn/wz/static/picture/1909201103.png
- http://tj##88.cn/wz/static/picture/1909201032.png
- http://tj##88.cn/wz/static/picture/img1.png
- http://tj##88.cn/wz/static/picture/right_icon.png
- http://tj##88.cn/wz/static/picture/left_icon.png
- http://tj##88.cn/wz/static/css/swiper.min.css
- http://tj##88.cn/wz/static/css/iconfont.css
- http://tj##88.cn/wz/static/css/reset.css
- http://tj##88.cn/wz/static/picture/banner.png
- http://tj##88.cn/wz/static/css/styles.f0c61ae4.chunk.css
- http://tj##88.cn/wz/static/css/commons.067e1a35.chunk.css
- http://tj##88.cn/wz/
- http://www.xx##8.com/run.js
- http://www.xx##8.com/css/hq/iconfont.eot?t=#############
- http://www.xx##8.com/jquery.js.php
- http://www.xx##8.com/jquery.min.sgcptjc.php
- http://www.xx##8.com/js/hq/index.min.js
- http://www.xx##8.com/css/hq/index.min.css
- http://www.xx##8.com/
- http://www.cf###gzi.com/
- http://tj##88.cn/wz/static/images/1909191632.png
- http://tj##88.cn/wz/static/favicon.ico
UDP
- DNS ASK cf###gzi.com
- DNS ASK xx##8.com
- DNS ASK vv.##zhikan.com
- DNS ASK hm.##idu.com
- DNS ASK zz.##ini180.com
- DNS ASK tj##88.cn
- 'localhost':61618
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\105.exe'
- '%WINDIR%\444.exe'
- '%WINDIR%\p13.exe'
- '%WINDIR%\syswow64\werfault.exe' -u -p 936 -s 376' (with hidden window)
