Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:7788;https=127.0.0.1:7788;'
Modifies file system
Creates the following files
- <Current directory>\fiddlercore4.dll
- %TEMP%\tmp6842.tmp
- %APPDATA%\microsoft\systemcertificates\my\keys\e772f2ea2ad005d9d576ba1506e9dea339252850
- %APPDATA%\microsoft\systemcertificates\my\certificates\ae3cc1aef3c1939f4f4c95e5ba01b8aa246120b0
- %APPDATA%\microsoft\systemcertificates\request\certificates\d78c6c4f4146c047ee2321b4d12e5c111b287394
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\6eee67e9c08a9deba70e8fa42bacf389_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b7842ee26a09937e701526f2755ae522_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmp630b.tmp
- %TEMP%\tmp62cc.tmp
- %APPDATA%\microsoft\systemcertificates\my\keys\137b1940c924b7a0444d4885ee9e81e7a5209e06
- %APPDATA%\microsoft\systemcertificates\my\certificates\5e293b43d2c367a5c55ec29571c8c8b2121bf863
- %APPDATA%\microsoft\systemcertificates\request\certificates\e1ab8a2b3d1b8cc6e24b366a3829b97791b75a9e
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4f537c61dfc2a60d03f428e345b8d9a0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6jnz21kg\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wxs5lft9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\vytf7oqd\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\c4cxbnyp\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- <Current directory>\makecert.exe
- <Current directory>\libeay32.dll
- <Current directory>\ssleay32.dll
- <Current directory>\certmaker.dll
- <Current directory>\bcmakecert.dll
- <Current directory>\efd.dll
- %TEMP%\tmp6853.tmp
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\4637387919b58df1070cc4e9dc4e8ae7_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\c4cxbnyp\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\vytf7oqd\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wxs5lft9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6jnz21kg\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- <Current directory>\makecert.exe
- <Current directory>\bcmakecert.dll
- <Current directory>\certmaker.dll
- %APPDATA%\microsoft\systemcertificates\request\certificates\e1ab8a2b3d1b8cc6e24b366a3829b97791b75a9e
- %TEMP%\tmp62cc.tmp
- %TEMP%\tmp630b.tmp
- %APPDATA%\microsoft\systemcertificates\request\certificates\d78c6c4f4146c047ee2321b4d12e5c111b287394
- %TEMP%\tmp6842.tmp
- %TEMP%\tmp6853.tmp
Substitutes the following files
- <Current directory>\makecert.exe
Network activity
Connects to
- 'localhost':7788
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Other
- 'localhost':49174
UDP
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
