Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=localhost:8000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=localhost:8000;https=localhost:8000'
Modifies file system
Creates the following files
- %TEMP%\tmpd592.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\z8pr22wd\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\dzdksq1g\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\n06a3y9j\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\9flsyre1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\a5a043c3e6007ae674e142d3a01ce5c7_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %TEMP%\tmpe719.tmp
- %PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\9b1891e767e3ad86f82c14cf08d6f0ca_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\84ef8e32cf3dd22e15e36759d999f0aa_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmpd6bc.tmp
- %APPDATA%\microsoft\systemcertificates\my\keys\a2de8fb71a5912e767bd2596d9faf1480aed1d15
- %APPDATA%\microsoft\systemcertificates\my\certificates\20dbe8a16ef848cb4a00fb3e4b58183a32c2f272
- <Current directory>\rootcert.pfx
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\84ef8e32cf3dd22e15e36759d999f0aa_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmpd5c1.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %HOMEPATH%\documents\useragent.txt
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\9flsyre1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\n06a3y9j\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\dzdksq1g\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\z8pr22wd\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\tmpd592.tmp
- %TEMP%\tmpd5c1.tmp
- %PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\84ef8e32cf3dd22e15e36759d999f0aa_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmpd6bc.tmp
- %TEMP%\tmpe719.tmp
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\84ef8e32cf3dd22e15e36759d999f0aa_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Substitutes the following files
- %PROGRAMDATA%\microsoft\crypto\rsa\machinekeys\84ef8e32cf3dd22e15e36759d999f0aa_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Network activity
Connects to
- 'localhost':8000
TCP
HTTP GET requests
- http://yo####perhost.com/
- http://yo####perhost.com/MySuperHost.com
UDP
- 'time.windows.com':123
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\certutil.exe' -importPFX -p "" -f "%TEMP%\tmpD6BC.tmp"' (with hidden window)
- '%WINDIR%\syswow64\certutil.exe' -importPFX -p "" -f "%TEMP%\tmpE719.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\certutil.exe' -importPFX -p "" -f "%TEMP%\tmpD6BC.tmp"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\certutil.exe' -importPFX -p "" -f "%TEMP%\tmpE719.tmp"
