Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [\REGISTRY\USER\S-1-5-21-1238866942-1249195528-555854008-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1400' = '00000003'
- [\REGISTRY\USER\S-1-5-21-1238866942-1249195528-555854008-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1C00' = '00000000'
Modifies file system
Creates the following files
- D:\users\user\appdata\local\temp\mz_etilqs_esf30985nq5ocnq
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\bc9a334d14ae8d5cdcf1f5f5128ba1f4cdd083ac
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\2cb84dd9abb4e1485d83397c59b193094e1abfc7
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\39d80535a21e286b3c662765c5f09aceb927e77d
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\microsoft\office\onetconfig\d797290701f29a555bd62d0c7643f8ed.sig
- D:\users\user\appdata\local\microsoft\office\onetconfig\d797290701f29a555bd62d0c7643f8ed.xml
- D:\system volume information\syscache.hve.log1
- D:\system volume information\syscache.hve
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\winevt\logs\application.evtx
- D:\programdata\microsoft\officesoftwareprotectionplatform\cache\cache.dat
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\dfdc36497a0baee2972009ee6deccc06c2e352c6
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
- D:\users\user\appdata\roaming\microsoft\office\recent\index.dat
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\9c571ec4d1abdf04dec3542cba1cbcdb49632bf7
- D:\windows\appcompat\programs\recentfilecache.bcf
- D:\windows\system32\config\software.log1
- D:\windows\system32\config\software
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\cf462cc01526cf7bccc759acb08bff8803c0f8af
- D:\users\user\appdata\local\temp\mz_etilqs_hhcvcs0aodbnrnc
- D:\users\user\ntuser.dat.log1
- D:\users\user\ntuser.dat
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\c7511574f457706090c16c56692a1597f9a22001
- D:\windows\system32\config\system.log1
- D:\windows\system32\config\system
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\security_state\data.safe.bin
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\7330b218fe46e63c30e077c3456a7239baaead12
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\a4bc0c99327d7691ff360f07d11373b5791eb30c
- D:\users\user\appdata\roaming\microsoft\office\recent\<File name>.lnk
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\oovndwuzbamdkuupmlxu.temp
Sets the 'hidden' attribute to the following files
- D:\users\user\appdata\roaming\microsoft\office\recent\index.dat
Deletes the following files
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\users\user\appdata\roaming\microsoft\office\recent\<File name>.lnk
- D:\users\user\appdata\local\microsoft\office\onetconfig\d797290701f29a555bd62d0c7643f8ed.xml
- D:\users\user\appdata\local\microsoft\office\onetconfig\d797290701f29a555bd62d0c7643f8ed.sig
Moves the following files
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\oovndwuzbamdkuupmlxu.temp to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\969252ce11249fdd.customdestinations-ms
Substitutes the following files
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\prefs-1.js
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js
- D:\users\user\appdata\roaming\microsoft\office\recent\<File name>.lnk
- D:\users\user\appdata\local\microsoft\office\onetconfig\d797290701f29a555bd62d0c7643f8ed.sig
- D:\users\user\appdata\local\microsoft\office\onetconfig\d797290701f29a555bd62d0c7643f8ed.xml
Network activity
TCP
Other
- 'fi#####.###tings.services.mozilla.com':443
- '34.##0.144.191':443
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
