Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SP00LSV' = 'c:\zi7pxmcv\c3px-ct35.bat'
Modifies file system
Creates the following files
- %TEMP%\~vis0000\vise32ex.dll
- %WINDIR%\rjqing.cj
- C:\zi7pxmcv\c3px-ct35.bat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\dnserrordiagoff_weboc[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\18²¥·åæ÷\18²¥·åæ÷.lnk
- %ProgramFiles(x86)%\18²¥·åæ÷\xiezaidll.bat
- %ProgramFiles(x86)%\18²¥·åæ÷\tvtongji.exe
- %HOMEPATH%\desktop\18²¥·åæ÷.lnk
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\bullet[1]
- %ProgramFiles(x86)%\18²¥·åæ÷\uninstal.log
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\navcancl[1]
- %ProgramFiles(x86)%\18²¥·åæ÷\hookmenu.ocx
- %ProgramFiles(x86)%\18²¥·åæ÷\18²¥·åæ÷.exe
- C:\sys\sp00lsv.exe
- %TEMP%\~vis0000\jpeg.dll
- %TEMP%\~vis0000\miscdata.xyz
- %TEMP%\~vis0000\rebootnt.exe
- %TEMP%\~vis0000\uninst32.exe
- %TEMP%\~vis0000\default.bmp
- %TEMP%\~vis0000\°²×°ГВјГЇГ±.jpg
- %TEMP%\~vis0000\uninstal.log
- %TEMP%\~vis0000\english.vlg
- %TEMP%\~vis0000\rollback.log
- %WINDIR%\syswow64\mscomctl.ocx
- %WINDIR%\syswow64\msinet.ocx
- %WINDIR%\syswow64\shdocvw.oca
- %WINDIR%\syswow64\mswinsck.ocx
- %ProgramFiles(x86)%\18²¥·åæ÷\rjbanben.cj
- %WINDIR%\rjmch.cj
- %ProgramFiles(x86)%\18²¥·åæ÷\rjyunxing.exe
- %WINDIR%\syswow64\comdlg32.ocx
- %WINDIR%\unvise32.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\18²¥·åæ÷\é¾³ý 18²¥·åæ÷.lnk
Sets the 'hidden' attribute to the following files
- %ProgramFiles(x86)%\18²¥·åæ÷\rjbanben.cj
Deletes the following files
- %TEMP%\~vis0000\miscdata.xyz
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
- %TEMP%\~vis0000\uninstal.log
- %TEMP%\~vis0000\uninst32.exe
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\Content.IE5\0U8LPYU9\ErrorPageTemplate[1]
Network activity
UDP
- DNS ASK tv.##kkkk.com
Miscellaneous
Searches for the following windows
- ClassName: 'CabinetWClass' WindowName: '%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\18²¥·ÅÆ÷'
- ClassName: 'CabinetWClass' WindowName: '18²¥·ÅÆ÷'
Creates and executes the following
- 'C:\sys\sp00lsv.exe'
- '%ProgramFiles%\185559~1\rjyunxing.exe' ' (with hidden window)
- '%ProgramFiles%\185559~1\tvtongji.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\PROGRA~2\185559~1\xiezaidll.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c c:\zi7pxmcv\c3px-ct35.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\PROGRA~2\185559~1\xiezaidll.bat" "
- '%WINDIR%\syswow64\regsvr32.exe' /u /s MMCShell.dll
- '%WINDIR%\syswow64\cmd.exe' /c c:\zi7pxmcv\c3px-ct35.bat
- '%WINDIR%\syswow64\mode.com' con cols=15 lines=1
- '%WINDIR%\syswow64\cmd.exe' /c @reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SP00LSjV"
- '%WINDIR%\syswow64\reg.exe' query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SP00LSjV"
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v SP00LSV /d c:\zi7pxmcv\c3px-ct35.bat /f
