Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\DLPOut.Document\Shell\Open\Command] '' = '%WINDIR%\DSEOFPS.exe "%1"'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\DlpStartService] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\DlpStartService] 'ImagePath' = '%WINDIR%\DSEDlpOfpsOutTemp\dseOutDir\DlpStartService.exe'
- [HKLM\System\CurrentControlSet\Services\DSESafeCtrlDrv] 'Start' = '00000001'
- [HKLM\System\CurrentControlSet\Services\DSESafeCtrlDrv] 'ImagePath' = '<DRIVERS>\DSESafeCtrlDrv.sys'
- [HKLM\System\CurrentControlSet\Services\effsoftdse] 'Start' = '00000001'
- [HKLM\System\CurrentControlSet\Services\effsoftdse] 'ImagePath' = '%WINDIR%\DSEDlpOfpsOutTemp\dseOutDir\DseDriver64.sys'
Creates the following services
- 'DlpStartService' %WINDIR%\DSEDlpOfpsOutTemp\dseOutDir\DlpStartService.exe
- 'DSESafeCtrlDrv' <DRIVERS>\DSESafeCtrlDrv.sys
- 'effsoftdse' %WINDIR%\DSEDlpOfpsOutTemp\dseOutDir\DseDriver64.sys
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\dseofps.exe
the following user processes:
- iexplore.exe
Hooks functions
in browsers
- firefox.exe process, wtsapi32.dll module
- firefox.exe process, advapi32.dll module
- firefox.exe process, cryptsp.dll module
- firefox.exe process, mswsock.dll module
- firefox.exe process, iphlpapi.dll module
- firefox.exe process, urlmon.dll module
- firefox.exe process, crypt32.dll module
- firefox.exe process, wsock32.dll module
- firefox.exe process, wininet.dll module
- firefox.exe process, nss3.dll module
- firefox.exe process, wintrust.dll module
- firefox.exe process, dnsapi.dll module
- firefox.exe process, netutils.dll module
Registers file system filter
- [HKLM\System\CurrentControlSet\Services\DSESafeCtrlDrv] 'Group' = 'FSFilter Top'
Modifies file system
Creates the following files
- %WINDIR%\dsedlpofpsouttemp\langxmls\sample chinese.lng.xml
- %WINDIR%\con.{645ff040-5081-101b-9f08-00aa002f954e}\s-22-{c88b516a-d3c0-4fb7-b713-cab6bea9ab7d}
- %WINDIR%\con.{645ff040-5081-101b-9f08-00aa002f954e}\s-22-{c88b516a-d3c0-4fb7-b713-cab6bea9ab7d}-journal
- %WINDIR%\syswow64\dlpoutfileicons.dll
- %WINDIR%\syswow64\printwatermark.dll
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\dlpstartservice.exe
- <SYSTEM32>\dlpoutfileicons64.dll
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\dseservice64.exe
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\dsesafectrldrv64.sys
- <DRIVERS>\dsesafectrldrv.sys
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\dsesafectrldrv.sys
- %WINDIR%\temp\uddb616.tmp
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\dsedriver64.sys
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\printwatermark64.dll
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\printwatermark.dll
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\dsefilesystemext64.dll
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\dsefilesystemext.dll
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\drvinterface.dll
- %WINDIR%\dsedlpofpsouttemp\effsoftfdc.png
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\ofps.log
- %WINDIR%\dseofps.exe
- %WINDIR%\dsedlpofpsouttemp\langxmls\tradition chinese.lng.xml
- %WINDIR%\dsedlpofpsouttemp\langxmls\english.lng.xml
- %WINDIR%\dsedlpofpsouttemp\dseoutdir\dsedriver32.sys
- %WINDIR%\temp\uddb655.tmp
Deletes the following files
- %WINDIR%\con.{645ff040-5081-101b-9f08-00aa002f954e}\s-22-{c88b516a-d3c0-4fb7-b713-cab6bea9ab7d}-journal
- %WINDIR%\temp\uddb655.tmp
- %WINDIR%\temp\uddb616.tmp
Moves the following files
- from <DRIVERS>\dsesafectrldrv.sys to <DRIVERS>\dsesafectrldrv.sys.old
Substitutes the following files
- <DRIVERS>\dsesafectrldrv.sys
- %WINDIR%\con.{645ff040-5081-101b-9f08-00aa002f954e}\s-22-{c88b516a-d3c0-4fb7-b713-cab6bea9ab7d}-journal
Network activity
UDP
- DNS ASK cn.##ol.ntp.org
- '21#.#2.145.44':123
- 'cn.##ol.ntp.org':123
Miscellaneous
Creates and executes the following
- '%WINDIR%\dseofps.exe'
- '%WINDIR%\dsedlpofpsouttemp\dseoutdir\dlpstartservice.exe' -i
- '%WINDIR%\dsedlpofpsouttemp\dseoutdir\dlpstartservice.exe'
- '%WINDIR%\dsedlpofpsouttemp\dseoutdir\dseservice64.exe' Inject -i -ns
- '%WINDIR%\dsedlpofpsouttemp\dseoutdir\dlpstartservice.exe' -i' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /s %WINDIR%\SysWOW64\DlpOutFileIcons.dll' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\DlpOutFileIcons64.dll' (with hidden window)
- '%WINDIR%\dsedlpofpsouttemp\dseoutdir\dseservice64.exe' Inject -i -ns' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %WINDIR%\SysWOW64\DlpOutFileIcons.dll
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\DlpOutFileIcons64.dll
