Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1C00' = '{00,00,00,00}'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:9666'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '127.0.0.1'
Modifies file system
Creates the following files
- <Current directory>\utmp\ngnbdyawam0u3m9w
- <Current directory>\utmp\xjaouwhjsu9j7l3h
- <Current directory>\utmp\lqbnqbjtzs7b2w8f
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\obu6enyz\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hqhzqf2x\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wr90hkxq\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\waovu9z6\desktop.ini
- <Current directory>\utmp\u.exe
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %HOMEPATH%\putty.rnd
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\obu6enyz\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hqhzqf2x\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wr90hkxq\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\waovu9z6\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Network activity
Connects to
- 'd1.###static.com':443
- 'ec###s1.msn.com':443
- 'gm##l.com':443
- 'a0.###static.com':443
- 'google.com':443
- 'ajax.microsoft.com':443
- 'ra####.vo.msecnd.net':443
- 'a.###.fastly.net':443
- 'localhost':9666
- 'aj##.#spnetcdn.com':443
- 'do.##ype.com':443
- 'iecvlist.microsoft.com':443
- 'd0.###static.com':443
- 'db#######poiv.cloudfront.net':443
- 'pr##.fastly.net':443
- 'a1.###static.com':443
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Other
- 'd1.###static.com':443
- 'ec###s1.msn.com':443
- 'gm##l.com':443
- 'a0.###static.com':443
- 'google.com':443
- 'ajax.microsoft.com':443
- 'a.###.fastly.net':443
- 'd0.###static.com':443
- 'db#######poiv.cloudfront.net':443
- 'pr##.fastly.net':443
- 'fa##ly.net':443
- 'mail.google.com':443
- 'a1.###static.com':443
UDP
- DNS ASK d8#######ohrb.cloudfront.net
- DNS ASK mail.google.com
- DNS ASK fa##ly.net
- DNS ASK pr##.fastly.net
- DNS ASK db#######poiv.cloudfront.net
- DNS ASK d0.###static.com
- DNS ASK iecvlist.microsoft.com
- DNS ASK do.##ype.com
- DNS ASK aj##.#spnetcdn.com
- DNS ASK vo.##ecnd.net
- DNS ASK ra####.vo.msecnd.net
- DNS ASK ajax.microsoft.com
- DNS ASK google.com
- DNS ASK a0.###static.com
- DNS ASK gm##l.com
- DNS ASK ec###s1.msn.com
- DNS ASK d1.###static.com
- DNS ASK a.###.fastly.net
- DNS ASK a1.###static.com
- 'localhost':57769
- 'localhost':57502
Miscellaneous
Creates and executes the following
- '<Current directory>\utmp\u.exe' -L="127.0.0.1:9666" -CID="40ff4932", -ProgPath="<Current directory>\\" -TmpPath="<Current directory>\utmp\\" -ConnMode=0 -version="1703100"
- '<Current directory>\utmp\u.exe' -L="127.0.0.1:9666" -CID="40ff4932", -ProgPath="<Current directory>\\" -TmpPath="<Current directory>\utmp\\" -ConnMode=0 -version="1703100"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
