Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:7788;https=127.0.0.1:7788;'
Modifies file system
Creates the following files
- <Current directory>\fiddlercore4.dll
- %TEMP%\tmp5dff.tmp
- %APPDATA%\microsoft\systemcertificates\my\keys\1ba18674c2eee13e8593b97a5fec6ea39da13b69
- %APPDATA%\microsoft\systemcertificates\my\certificates\d2a4a228b9f89222a8c3ce4be69c914069e6a307
- %APPDATA%\microsoft\systemcertificates\request\certificates\cb9320b6cec88b9fa30fbbb411811523b35ccb32
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\iiibqizt\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xbqgjgoj\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\pjshp3e0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f3up0oi7\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\9966aa255e8a0949ce9b2531e8173d1d_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\qy\ssl.cert
- %APPDATA%\qy\ssl.key
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b737c9bd743e6a5577244cca8ecfa939_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmp517e.tmp
- %TEMP%\tmp516d.tmp
- %APPDATA%\microsoft\systemcertificates\my\keys\e825e1bc12598bd91826f913a56a3229e4ac45f8
- %APPDATA%\microsoft\systemcertificates\my\certificates\0e83a3dcac6a098ec2d9f6dfec420d1c3727f4e6
- %APPDATA%\microsoft\systemcertificates\request\certificates\fe391a90264329fb356f923eb363795d1eac43a8
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\1f34693993dfff8151344be08f8c6222_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- <Current directory>\makecert.exe
- <Current directory>\libeay32.dll
- <Current directory>\ssleay32.dll
- <Current directory>\efd.dll
- %TEMP%\tmp5e00.tmp
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\6a4fe44421a3766ebcb04c5a6863488b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f3up0oi7\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\pjshp3e0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xbqgjgoj\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\iiibqizt\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- %APPDATA%\microsoft\systemcertificates\request\certificates\fe391a90264329fb356f923eb363795d1eac43a8
- %TEMP%\tmp516d.tmp
- %TEMP%\tmp517e.tmp
- %APPDATA%\microsoft\systemcertificates\request\certificates\cb9320b6cec88b9fa30fbbb411811523b35ccb32
- %TEMP%\tmp5dff.tmp
- %TEMP%\tmp5e00.tmp
Network activity
Connects to
- 'microsoft.com':80
- 'localhost':7788
- 'st####.rapidssl.com':80
- 'oc##.#tartssl.com':80
- 'public-trust.com':80
TCP
HTTP GET requests
- http://st####.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhhZrQET0hvbSHUJmNfBKqR%2FiT7wQUU8oXWfxrwAMhLxqu5KqoHIJW2nUCEA8RAzFf4a7BlufTueeio%2F0%3D
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
UDP
- DNS ASK microsoft.com
- DNS ASK st####.rapidssl.com
- DNS ASK oc##.#tartssl.com
- DNS ASK public-trust.com
Miscellaneous
Adds a root certificate
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\wininet.dll",DispatchAPICall 1
