Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'ENote' = '"%ProgramFiles(x86)%\ENote\main\EasyNotebook.exe" -h'
Creates or modifies the following files
- <SYSTEM32>\tasks\资讯热点-9
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\NetLogWatcher] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NetLogWatcher] 'ImagePath' = '%ProgramFiles(x86)%\MicrosofService\TeachService.exe'
Creates the following services
- 'NetLogWatcher' %ProgramFiles(x86)%\MicrosofService\TeachService.exe
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://ha#.#70353.com/
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\main.7z
- %ProgramFiles(x86)%\enote\main\data\note.db
- %APPDATA%\wbservice\reregisty.dll
- %APPDATA%\wbservice\wempnetwk.exe
- %APPDATA%\wbservice\uegnent.exe
- %APPDATA%\wbservice\z8xs6.7z
- %APPDATA%\emtree\presenitaty.exe
- %APPDATA%\emtree\dfkieky.exe
- %APPDATA%\emtree\bswx2.7z
- %APPDATA%\wbservice\config.ini
- %APPDATA%\emtree\config.ini
- %ProgramFiles(x86)%\enotepad\update.exe
- %ProgramFiles(x86)%\enotepad\self.ico
- %ProgramFiles(x86)%\enotepad\enoteservice.exe
- %ProgramFiles(x86)%\enotepad\easynotebook.exe
- %ProgramFiles(x86)%\enotepad\config.ini
- %ProgramFiles(x86)%\enotepad\calculator.dll
- %ProgramFiles(x86)%\enotepad\7z.dll
- %ProgramFiles(x86)%\microsofservice\teachservice.exe
- %APPDATA%\keephelp\notekeep_64.dll
- %APPDATA%\keephelp\notekeep.dll
- %APPDATA%\main.7z
- %ProgramFiles(x86)%\enote\main\calculator.dll
- %ProgramFiles(x86)%\enote\main\7z.dll
- %ProgramFiles(x86)%\enote\main\update.exe
- %ProgramFiles(x86)%\enote\un\uninst000.exe
- %ProgramFiles(x86)%\enote\main\enoteservice.exe
- %ProgramFiles(x86)%\enote\main\easynotebook.exe
- %ProgramFiles(x86)%\enote\main\config.ini
- %ProgramFiles(x86)%\enote\main\self.ico
- %TEMP%\ie.ico
- %APPDATA%\wbservice\data\imagecache\0617_64.ico
Deletes the following files
- %ProgramFiles(x86)%\main.7z
- %APPDATA%\main.7z
- %ProgramFiles(x86)%\enotepad\calculator.dll
- %ProgramFiles(x86)%\enotepad\easynotebook.exe
- %ProgramFiles(x86)%\enotepad\update.exe
- %ProgramFiles(x86)%\enotepad\self.ico
- %ProgramFiles(x86)%\enotepad\config.ini
- %APPDATA%\emtree\bswx2.7z
- %APPDATA%\wbservice\z8xs6.7z
- %APPDATA%\wbservice\reregisty.dll
Modifies the following files
- C:\users\public\desktop\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk
- C:\users\public\desktop\mozilla firefox.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla firefox.lnk
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk
Substitutes the following files
- %ProgramFiles(x86)%\main.7z
Network activity
Connects to
- 'dc##.#aomeil.com':80
- 'ip##.#aomeil.com':80
- 'us####.nnad.yaomeil.com':80
- 'ce####.nn.yaomeil.com':80
- 'gg#####.nnad.yaomeil.com':80
- 'lu####.huashigroup.cn':80
- 'eo##.dgygpx.com':80
- 'oh##.jdypf.com':80
TCP
HTTP GET requests
- http://dc##.#aomeil.com/note/easynote.ini
- http://ip##.#aomeil.com/api/tempip.ashx?ac###############################
- http://us####.nnad.yaomeil.com/count.do?sc#######################################################################################################################################################...
- http://ce####.nn.yaomeil.com/peaceworld.do?31####################################################################################################################################################...
- http://ce####.nn.yaomeil.com/peaceworld.do?%3####################################################################################################################################################...
- http://gg#####.nnad.yaomeil.com/pinforesults.do?sc###############################################################################################
- http://dc##.#aomeil.com/note/freednote.ini
- http://dc##.#aomeil.com/note/freedtaskb.ini
- http://lu####.huashigroup.cn/cgi/NNWindowPopConfiguration.ashx/videodesktop/getlist?en######
- http://gg#####.nnad.yaomeil.com/pinforesults.do?sc#################################################################################################
- http://eo##.dgygpx.com/yxh/img/nwie.ico
- http://oh##.jdypf.com/yxh/img/0617_64.ico
UDP
- DNS ASK dc##.#aomeil.com
- DNS ASK ba##u.com
- DNS ASK ip##.#aomeil.com
- DNS ASK us####.nnad.yaomeil.com
- DNS ASK ce####.nn.yaomeil.com
- DNS ASK gg#####.nnad.yaomeil.com
- DNS ASK lu####.huashigroup.cn
- DNS ASK eo##.dgygpx.com
- DNS ASK oh##.jdypf.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\enote\main\easynotebook.exe' -h
- '%ProgramFiles(x86)%\enote\main\enoteservice.exe' 2436 1140 -h
- '%APPDATA%\emtree\dfkieky.exe'
- '%APPDATA%\emtree\presenitaty.exe'
- '%APPDATA%\wbservice\uegnent.exe'
- '%APPDATA%\wbservice\wempnetwk.exe'
- '%WINDIR%\syswow64\regsvr32.exe' /s /u "%APPDATA%\KeepHelp\NoteKeep_64.dll"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla firefox.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "c:\users\public\desktop\google chrome.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "c:\users\public\desktop\mozilla firefox.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create NetLogWatcher binpath= "%ProgramFiles(x86)%\MicrosofService\TeachService.exe" start= auto' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /s "%APPDATA%\KeepHelp\NoteKeep_64.dll"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s /u "%APPDATA%\KeepHelp\NoteKeep_64.dll"
- '<SYSTEM32>\regsvr32.exe' /s /u "%APPDATA%\KeepHelp\NoteKeep_64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%APPDATA%\KeepHelp\NoteKeep_64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\KeepHelp\NoteKeep_64.dll"
- '%WINDIR%\syswow64\sc.exe' create NetLogWatcher binpath= "%ProgramFiles(x86)%\MicrosofService\TeachService.exe" start= auto
- '%WINDIR%\syswow64\attrib.exe' +r "c:\users\public\desktop\google chrome.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "c:\users\public\desktop\mozilla firefox.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla firefox.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk"
