Technical Information
Malicious functions
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' http://toolsbar.kuaiso.com/setup/installok_0602307.htm
Modifies file system
Creates the following files
- %TEMP%\nsbf0a6.tmp
- %TEMP%\searchcar.exe
- %TEMP%\5067.exe
- %TEMP%\bind_40047.exe
- %TEMP%\rich572.exe
- %TEMP%\nsyf6a1.tmp
- %ALLUSERSPROFILE%\application data\microsoft\iehelper\iehelper_5067.dll
- %ProgramFiles(x86)%\searchcar\searchcar.dll
- %ProgramFiles(x86)%\searchcar\basis.xml
- %ProgramFiles(x86)%\searchcar\version.txt
- %ProgramFiles(x86)%\searchcar\weather.bmp
- %ProgramFiles(x86)%\searchcar\tv.bmp
- %ProgramFiles(x86)%\searchcar\mp3.bmp
- %ProgramFiles(x86)%\searchcar\icons.bmp
- %ProgramFiles(x86)%\searchcar\standard_icons.bmp
- %ProgramFiles(x86)%\searchcar\shoucang.bmp
- %ProgramFiles(x86)%\searchcar\ring.bmp
- %ProgramFiles(x86)%\searchcar\block.bmp
- %ProgramFiles(x86)%\searchcar\film.bmp
- %ProgramFiles(x86)%\searchcar\lianmeng.bmp
- %ProgramFiles(x86)%\searchcar\+.bmp
- %ProgramFiles(x86)%\searchcar\-.bmp
- %ProgramFiles(x86)%\searchcar\find.bmp
- %ProgramFiles(x86)%\searchcar\home.bmp
- %ProgramFiles(x86)%\searchcar\clean.bmp
- %ProgramFiles(x86)%\searchcar\searchcar.crc
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f683dc-e54.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f683e0-43c.pma
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f683dc-e54.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f683e0-43c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Network activity
Connects to
- 'mo##ad.com':80
- '16#.#59.142.9':80
- 'co####.edge.skype.com':443
TCP
HTTP GET requests
Other
- 'co####.edge.skype.com':443
UDP
- DNS ASK fi##.#nionsms.net
- DNS ASK fi###.unionsms.net
- DNS ASK w5.##kead.com
- DNS ASK w1.##kead.com
- DNS ASK to####ar.kuaiso.com
- DNS ASK w4.##kead.com
- DNS ASK w3.##kead.com
- DNS ASK w2.##kead.com
- DNS ASK mo##ad.com
- DNS ASK co####.edge.skype.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\searchcar.exe'
- '%TEMP%\5067.exe'
- '%TEMP%\bind_40047.exe'
- '%TEMP%\rich572.exe'
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\SearchCar\SearchCar.dll"
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\bho\ie_to_edge_stub.exe' --from-ie-to-edge=3 --ie-frame-hwnd=402b2
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=402b2
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=402b2 --flag-switches-begin --flag-switches-end --do-not-de-elevate
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --from-ie-to-edge=3 --ie-frame-hwnd=402b2 --flag-switches-begin --flag-switches-end --do-not-de-elevate' (with hidden window)
