Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:7788;https=127.0.0.1:7788;'
Modifies file system
Creates the following files
- <Current directory>\fiddlercore4.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\p8tirmp2\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ur6ptt1m\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\b3dj6dnk\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7wq9edns\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\3779319bfe0fdea1812cb2871f78f835_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmpabd2.tmp
- %TEMP%\tmpabc1.tmp
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %APPDATA%\microsoft\systemcertificates\my\keys\8c034336f80bfe05b2ce3962ad608ac333dd9a7e
- %APPDATA%\microsoft\systemcertificates\request\certificates\a39f832a3bfeccccfcb1f8f449f828c2afa4491b
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\0d864990d1c4f41004c0528c045409b9_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\qy\ssl.cert
- %APPDATA%\qy\ssl.key
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\38bf8bcfda604565a91d4e2b8528f8dd_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmpa27b.tmp
- %TEMP%\tmpa25a.tmp
- %APPDATA%\microsoft\systemcertificates\my\keys\f6ea235c1c9ee465c00c6e0a0190b65cafd0aa47
- %APPDATA%\microsoft\systemcertificates\my\certificates\e74a04a391ea6999dba76fd8370c5593cf27165d
- %APPDATA%\microsoft\systemcertificates\request\certificates\8b8795090ba3a4a56b2f213bfb995fd36ecc2c9e
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d778235de69115246dbd5881760f43e1_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- <Current directory>\efd.dll
- %APPDATA%\microsoft\systemcertificates\my\certificates\0d4a799a942ebe671bf014bf679893a1727c2641
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7wq9edns\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\b3dj6dnk\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ur6ptt1m\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\p8tirmp2\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- %APPDATA%\microsoft\systemcertificates\request\certificates\8b8795090ba3a4a56b2f213bfb995fd36ecc2c9e
- %TEMP%\tmpa25a.tmp
- %TEMP%\tmpa27b.tmp
- %APPDATA%\microsoft\systemcertificates\request\certificates\a39f832a3bfeccccfcb1f8f449f828c2afa4491b
- %TEMP%\tmpabc1.tmp
- %TEMP%\tmpabd2.tmp
Network activity
Connects to
- 'microsoft.com':80
UDP
- DNS ASK microsoft.com
Miscellaneous
Adds a root certificate
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
