Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\circlass] 'ImagePath' = 'system32\DRIVERS\circlass.sys'
Creates the following services
- 'circlass' system32\DRIVERS\circlass.sys
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM QuickStart.exe
- '<SYSTEM32>\taskkill.exe' /F /IM "IR Learning Wizard.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM QuickTV.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ehunserv.exe
- '<SYSTEM32>\taskkill.exe' /F /IM AVerTV.exe
Modifies file system
Creates the following files
- %TEMP%\nsr5ef2.tmp\system.dll
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\install.bmp
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\installdriver.exe
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\mvdetection64.ax
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\proppage_cd311.ax
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\proppage_cd311_x64.ax
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\remove.bmp
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\removedriver.exe
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\renesas-usb3-host-driver-30230-setup.exe
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\avmu3cd311_x64.sys
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\customer_averfx3.bin
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\setup.iss
- %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setce47.tmp
- %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setcf51.tmp
- %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setd0aa.tmp
- %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setd1b4.tmp
- %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setd2dd.tmp
- %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setd80c.tmp
- %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setd936.tmp
- %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setda30.tmp
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\tvrate.dll
- %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setcd2d.tmp
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\avmu3cd311_x64.inf
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\avmu3cd311_x64.cat
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\aver_custom_out_of_range.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\installdriver.exe
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\mvdetection64.ax
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\proppage_cd311.ax
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\proppage_cd311_x64.ax
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\renesas-usb3-host-driver-30230-setup.exe
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\remove.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\removedriver.exe
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\tvrate.dll
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\aver_custom_content_protection.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\install.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\aver_custom_hdcp_protection.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\aver_custom_out_of_range.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\avmu3cd311_x64.cat
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\avmu3cd311_x64.inf
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\avmu3cd311_x64.sys
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\customer_averfx3.bin
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\setup.iss
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\aver_custom_content_protection.bmp
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\aver_custom_hdcp_protection.bmp
- %WINDIR%\driver cache\avermedia\avmu3cd31164_2.0.64.94\aver_custom_no_signal.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\aver_custom_no_signal.bmp
- %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setdb5a.tmp
- %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setdc64.tmp
Moves the following files
- from %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setcd2d.tmp to %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\customer_averfx3.bin
- from %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setce47.tmp to %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\mvdetection64.ax
- from %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setcf51.tmp to %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\avmu3cd311_x64.sys
- from %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setd0aa.tmp to %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\proppage_cd311.ax
- from %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setd1b4.tmp to %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\aver_custom_content_protection.bmp
- from %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setd2dd.tmp to %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\aver_custom_no_signal.bmp
- from %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setd80c.tmp to %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\aver_custom_hdcp_protection.bmp
- from %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setd936.tmp to %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\proppage_cd311_x64.ax
- from %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setda30.tmp to %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\aver_custom_out_of_range.bmp
- from %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setdb5a.tmp to %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\avmu3cd311_x64.cat
- from %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\setdc64.tmp to %TEMP%\{24c21402-56e1-05a1-2165-9815a9b4636e}\avmu3cd311_x64.inf
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'AVerQTApp' WindowName: ''
- ClassName: 'AVerTrayIconAPP' WindowName: ''
- ClassName: 'AVerQuickApp' WindowName: ''
- ClassName: 'AmaQuickStart' WindowName: ''
- ClassName: 'QuickTVApp' WindowName: ''
- ClassName: '' WindowName: 'eHome Service'
- ClassName: 'AVerTVApp' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\avermedia\avermedia cd311 pcie hd capture device\installdriver.exe' /s
- '<SYSTEM32>\taskkill.exe' /F /IM QuickStart.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM "IR Learning Wizard.exe"' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM QuickTV.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ehunserv.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM AVerTV.exe' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{5256e5ec-4d90-4198-8752-a22504c15934} Global\{04c22ee2-329f-50d4-dfb3-582a20d5e335} <DRIVERSTORE>\Temp\{6225646a-d393-6271-92e8-2d79...
