Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:8888;https=127.0.0.1:8888;'
Modifies file system
Creates the following files
- <Current directory>\fiddlercore4.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ptz31l5r\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\d8nuowt3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7wjwj0mq\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yez3g7iv\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\10dfbc8f14ef86d551017e1caf62e5b5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmp552a.tmp
- %TEMP%\tmp5529.tmp
- %APPDATA%\microsoft\systemcertificates\my\keys\a26ae9ee9a38fdd8c74f89c84073b2220d36193f
- %APPDATA%\microsoft\systemcertificates\my\certificates\3b29a70920f6dc257be4e69177be6434ca39654c
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %APPDATA%\microsoft\systemcertificates\request\certificates\1d2a922b43e37ec8892bfc65df41a50a4370b34b
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\30ae4a66891b96caf9360d7443fa4f22_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\564e979930ad2d01ed593a70c4d01c45_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmp4c7f.tmp
- %TEMP%\tmp4c6e.tmp
- %APPDATA%\microsoft\systemcertificates\my\keys\ea1d84fd072d3b6682e1b9258161d499e5015e5f
- %APPDATA%\microsoft\systemcertificates\my\certificates\095d110c5ce5e0c94e4129ab0fdedf56c5b926ba
- %APPDATA%\microsoft\systemcertificates\request\certificates\e10c34c013fe11247d53476f2b7a265cc971d14d
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3bdd9b2fc7f671e2897bf249cc2e3d90_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- <Current directory>\makecert.exe
- <Current directory>\libeay32.dll
- <Current directory>\ssleay32.dll
- <Current directory>\efd.dll
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yez3g7iv\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7wjwj0mq\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\d8nuowt3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ptz31l5r\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- %APPDATA%\microsoft\systemcertificates\request\certificates\e10c34c013fe11247d53476f2b7a265cc971d14d
- %TEMP%\tmp4c6e.tmp
- %TEMP%\tmp4c7f.tmp
- %APPDATA%\microsoft\systemcertificates\request\certificates\1d2a922b43e37ec8892bfc65df41a50a4370b34b
- %TEMP%\tmp5529.tmp
- %TEMP%\tmp552a.tmp
Network activity
Connects to
- 'localhost':8888
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Adds a root certificate
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\wininet.dll",DispatchAPICall 1
