Technical Information
Modifies file system
Creates the following files
- C:\ace
- C:\æô¶¯.dll
- C:\ie_homepage.reg
Sets the 'hidden' attribute to the following files
- C:\ace
Deletes the following files
- <DRIVERS>\etc\hosts
- C:\ie_homepage.reg
Moves the following files
- from C:\æô¶¯.dll to %TEMP%\1165686\....\caonima.exe
Substitutes the following executable files
- <Full path to file>
Substitutes the following files
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Moves itself
- from <Full path to file> to %TEMP%\[7967218964ae4cf1d4d16b21f5e0a8d2]
Network activity
Connects to
- '82##g.com':80
- 'w.###ata.net':80
TCP
HTTP GET requests
- http://www.82##g.com/hosts.txt
HTTP POST requests
- http://w.###ata.net/9793854cb063b0b7
UDP
- DNS ASK 82##g.com
- DNS ASK w.###ata.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'TGuardSvc.exe'
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p everyone:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p system:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrator:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrators:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p Users:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p guests:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p replicator:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p everyone:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p system:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrator:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrators:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p Users:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p guests:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p replicator:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:R' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p everyone:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p Users:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p replicator:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p administrator:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p guests:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p everyone:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p administrators:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p system:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p replicator:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p guests:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p Users:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrators:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrator:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p system:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p everyone:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p administrator:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p Users:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p replicator:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p administrators:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p system:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p everyone:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p replicator:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p guests:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p Users:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrators:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrator:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p system:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p guests:F
- '%WINDIR%\syswow64\regedit.exe' /s C:/IE_HomePage.reg
