Technical Information
Malicious functions
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' "http://youword.cn/cnppaaa.htm?soft201003a?mac=EC:59:F1:DE:BC:30&ver=1.0"
- '%ProgramFiles%\internet explorer\iexplore.exe' "http://www.fxxzdown.cn/images/star/tj.html?mac=EC:59:F1:DE:BC:30&ver=1.0"
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 572
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 2752
- '%WINDIR%\syswow64\net.exe' stop sharedaccess
Modifies file system
Creates the following files
- C:\t1.exe
- C:\svchost.exe
- %ProgramFiles%\705.5475.bat
- %TEMP%\nsd4c2.tmp\project1.exe
- %TEMP%\nsd4c2.tmp\soft201003.exe
- %WINDIR%\705.5475.bat
- %WINDIR%\syswow64\drivers\noiepad.exe
- %HOMEPATH%\desktop\internet explorer.url
- %ProgramFiles%\svchost.exe
- %WINDIR%\soft201003.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\internet explorer.lnk
- %ProgramFiles%\vstart.exe
- %WINDIR%\systemwindows.exe
Deletes the following files
- C:\svchost.exe
- %TEMP%\nsd4c2.tmp\soft201003.exe
Modifies the following files
- %HOMEPATH%\desktop\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk
Modifies the HOSTS file.
Network activity
Connects to
- 'bl###.com.cn':80
- 'yo##ord.cn':80
- 'fx##down.cn':80
TCP
HTTP GET requests
- http://www.bl###.com.cn/popconfig.xml
- http://yo##ord.cn/addown3/cpa.txt
- http://www.fx##down.cn/images/star/tj.html?ma###########################
- http://www.fx##down.cn/images/star/cpa.txt
- http://yo##ord.cn/cnppaaa.htm?so#######################################
UDP
- DNS ASK 57##3.com
- DNS ASK bl###.com.cn
- DNS ASK fx##down.cn
- DNS ASK yo##ord.cn
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Media Center Tray Applet' WindowName: ''
Creates and executes the following
- 'C:\t1.exe'
- 'C:\svchost.exe'
- '%TEMP%\nsd4c2.tmp\soft201003.exe'
- '%TEMP%\nsd4c2.tmp\project1.exe'
- '%ProgramFiles%\svchost.exe'
- '%WINDIR%\soft201003.exe'
- '%WINDIR%\systemwindows.exe'
- '%ProgramFiles%\vstart.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\705.5475.bat""
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\705.5475.bat
- '%WINDIR%\syswow64\net1.exe' stop sharedaccess
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\ctfmon.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\705.5475.bat""' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\705.5475.bat' (with hidden window)
- '%ProgramFiles%\internet explorer\iexplore.exe' "http://youword.cn/cnppaaa.htm?soft201003a?mac=EC:59:F1:DE:BC:30&ver=1.0"' (with hidden window)
- '%ProgramFiles%\internet explorer\iexplore.exe' "http://www.fxxzdown.cn/images/star/tj.html?mac=EC:59:F1:DE:BC:30&ver=1.0"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 572' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 2752' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop sharedaccess' (with hidden window)
