Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_20140709231037' = '"%PROGRAM_FILES%\wjplay2\20140709231037\wjplay.exe" -mini'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_News_20140709231037' = '"%PROGRAM_FILES%\wjplay2\20140709231037\WJSpeed.exe" -mini'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\woayavc_30309.exe' = '%PROGRAM_FILES%\Your Product\woayavc_30309.exe:*:Enabled:百度杀毒在线安装程序'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\woayavc_30309.exe' = '%PROGRAM_FILES%\Your Product\woayavc_30309.exe:*:Enabled:百度杀毒在线安装程序'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\meinvying\meinvying.exe' = '%PROGRAM_FILES%\meinvying\meinvying.exe:*:Enabled:ГАЕ®УЄ'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\nsm5.tmp\meinvying.exe' = '%TEMP%\nsm5.tmp\meinvying.exe:*:Enabled:ГАЕ®УЄ'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe' = '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe:*:Enabled:百度卫士在线安装程序'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe' = '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe:*:Enabled:百度卫士在线安装程序'
Creates and executes the following:
- '%PROGRAM_FILES%\Your Product\setup_194a_p.exe'
- '%PROGRAM_FILES%\Your Product\woayavc_30309.exe'
- '%TEMP%\nsm5.tmp\meinvying.exe' /fix
- '%PROGRAM_FILES%\wjplay2\20140709231037\wjplay.exe' -mini
- '%PROGRAM_FILES%\meinvying\meinvying.exe' /A
- '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe'
- '%PROGRAM_FILES%\Your Product\setup_open_4705-2508.exe'
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:629794 "__IRAFN:<Full path to virus>" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
- '%PROGRAM_FILES%\Your Product\pczh_107_2508.exe'
- '%PROGRAM_FILES%\Your Product\QQЧЁ°жv1.exe'
- '%PROGRAM_FILES%\Your Product\-8670_2508_mm.exe'
Executes the following:
- '<SYSTEM32>\taskkill.exe' /F /im mvhd.exe
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\FlashFXP]
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\广告神盾\res\img\con3.png
- %PROGRAM_FILES%\广告神盾\res\img\con2.png
- %PROGRAM_FILES%\广告神盾\res\img\guan.png
- %PROGRAM_FILES%\广告神盾\res\img\foot.png
- %PROGRAM_FILES%\广告神盾\res\img\con1.png
- %PROGRAM_FILES%\广告神盾\res\img\1.png
- %ALLUSERSPROFILE%\Desktop\wjplay2.lnk
- %HOMEPATH%\Start Menu\Programs\wjplay2\wjplay2.lnk
- %PROGRAM_FILES%\广告神盾\res\img\2.png
- %PROGRAM_FILES%\广告神盾\res\img\icon2.gif
- %HOMEPATH%\Start Menu\Programs\wjplay2\ЕдЦГ№¤ѕЯ\Р¶ФШwjplay2.lnk
- %PROGRAM_FILES%\广告神盾\res\img\t1.png
- %PROGRAM_FILES%\广告神盾\res\img\t1_1_1.png
- %PROGRAM_FILES%\广告神盾\res\img\t1_1.png
- %PROGRAM_FILES%\广告神盾\res\img\t.png
- %PROGRAM_FILES%\广告神盾\res\img\logo.png
- %PROGRAM_FILES%\广告神盾\res\img\kai.png
- %PROGRAM_FILES%\广告神盾\res\img\logo36.png
- %HOMEPATH%\Start Menu\Programs\wjplay2\№Щ·ЅЦчТі.lnk
- %PROGRAM_FILES%\广告神盾\res\css\BackgroundTip.css
- %TEMP%\nsvC.tmp\tmpndcodz.dll
- %PROGRAM_FILES%\meinvying\ГАЕ®УЄ.lnk
- %PROGRAM_FILES%\广告神盾\res\css\common.css
- %PROGRAM_FILES%\广告神盾\res\BackgroundTip.html
- %PROGRAM_FILES%\wjplay2\20140709231037\Unins.exe
- %PROGRAM_FILES%\wjplay2\20140709231037\SysConfig.ini
- %PROGRAM_FILES%\wjplay2\20140709231037\WJSpeed.exe
- %PROGRAM_FILES%\wjplay2\20140709231037\wjplay.exe
- %PROGRAM_FILES%\广告神盾\res\css\index.css
- %PROGRAM_FILES%\广告神盾\res\img\0006.gif
- %ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\Р¶ФШГАЕ®УЄ.lnk
- %PROGRAM_FILES%\广告神盾\res\img\0007.gif
- %ALLUSERSPROFILE%\Desktop\ГАЕ®УЄ.lnk
- %PROGRAM_FILES%\广告神盾\res\css\window.css
- %PROGRAM_FILES%\广告神盾\res\css\InterceptedTip.css
- %HOMEPATH%\Templates\920147231032640\YYM_955WD30.gif
- %PROGRAM_FILES%\广告神盾\res\css\TrunOnRunTip.css
- %ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\ГАЕ®УЄ.lnk
- %PROGRAM_FILES%\广告神盾\res\img\t2.png
- %PROGRAM_FILES%\广告神盾\res\js\settings.js
- %PROGRAM_FILES%\广告神盾\res\js\progress.js
- %PROGRAM_FILES%\广告神盾\res\settings.html
- %PROGRAM_FILES%\广告神盾\res\msgbox.html
- %PROGRAM_FILES%\广告神盾\res\js\json2.js
- %PROGRAM_FILES%\广告神盾\res\js\common.js
- %PROGRAM_FILES%\广告神盾\res\InterceptedTip.html
- %PROGRAM_FILES%\广告神盾\res\js\jquery-1.10.2.min.js
- %PROGRAM_FILES%\广告神盾\res\js\index.js
- %PROGRAM_FILES%\广告神盾\res\sound\tip.wav
- %PROGRAM_FILES%\aqingz3.7\uninstall.exe
- %PROGRAM_FILES%\aqingz3.7\Aqingz3.7.exe
- %PROGRAM_FILES%\aqingz3.7\Winsvr.exe
- %PROGRAM_FILES%\aqingz3.7\lovmon.exe
- %PROGRAM_FILES%\广告神盾\server\AdShieldServer.exe
- %PROGRAM_FILES%\广告神盾\res\tip.html
- %PROGRAM_FILES%\广告神盾\res\tip.htm
- %PROGRAM_FILES%\广告神盾\res\window.html
- %PROGRAM_FILES%\广告神盾\res\TrunOnRunTip.html
- %PROGRAM_FILES%\广告神盾\res\img\top1.png
- %HOMEPATH%\Favorites\Гв·СЙПНшµјєЅ.url
- %PROGRAM_FILES%\广告神盾\res\img\top2.png
- %HOMEPATH%\Favorites\МмТнѕьКВНш.url
- %PROGRAM_FILES%\广告神盾\res\img\t3_1_1.png
- %PROGRAM_FILES%\广告神盾\res\img\t2_1_1.png
- %PROGRAM_FILES%\广告神盾\res\img\t2_1.png
- %PROGRAM_FILES%\广告神盾\res\img\t3_1.png
- %PROGRAM_FILES%\广告神盾\res\img\t3.png
- %PROGRAM_FILES%\广告神盾\res\img\x.png
- %PROGRAM_FILES%\广告神盾\res\img\_0028_.png
- %PROGRAM_FILES%\广告神盾\res\img\_0025_.png
- %PROGRAM_FILES%\广告神盾\res\index.html
- %PROGRAM_FILES%\广告神盾\res\img\.jpg
- %PROGRAM_FILES%\广告神盾\res\img\_0024_ȫ.png
- %PROGRAM_FILES%\广告神盾\res\img\ykai.png
- %PROGRAM_FILES%\广告神盾\res\img\yguan.png
- %PROGRAM_FILES%\广告神盾\res\img\_0020_ѿ.png
- %PROGRAM_FILES%\广告神盾\res\img\yun.png
- %PROGRAM_FILES%\广告神盾\cfg.ini
- %HOMEPATH%\Start Menu\Programs\Your Product\Uninstall Your Product.lnk
- %PROGRAM_FILES%\Your Product\Uninstall\IRIMG2.JPG
- %TEMP%\nsm5.tmp\System.dll
- %TEMP%\nsq3.tmp
- %PROGRAM_FILES%\Your Product\Uninstall\IRIMG1.JPG
- %HOMEPATH%\Start Menu\Programs\Your Product\pczh_107_2508.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\№гёжЙс¶Ь°ІЧ°іМРт.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\woayavc_30309.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\qrgxdr_70739.lnk
- %TEMP%\nsm5.tmp\meinvying.exe
- %APPDATA%\FwNetwork\广告神盾\data.zip
- %TEMP%\nsf9.tmp\res\onlineWnd.zip
- %TEMP%\nsf9.tmp\BDMSkin.dll
- %TEMP%\nsvC.tmp\BDMSkin.dll
- %TEMP%\nsvC.tmp\res\onlineWnd.zip
- %TEMP%\nsh6.tmp\System.dll
- %TEMP%\nsh6.tmp\Base64.dll
- %TEMP%\nsvB.tmp
- %TEMP%\nse8.tmp
- %PROGRAM_FILES%\Your Product\Uninstall\uninstall.dat
- %PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
- %PROGRAM_FILES%\Your Product\Uninstall\uninstall.xml
- %PROGRAM_FILES%\Your Product\uninstall.exe
- %TEMP%\Your Product Setup Log.txt
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %PROGRAM_FILES%\Your Product\QQЧЁ°жv1.exe
- %HOMEPATH%\Start Menu\Programs\Your Product\QQЧЁ°ж.lnk
- %PROGRAM_FILES%\Your Product\woayavc_30309.exe
- %HOMEPATH%\Start Menu\Programs\Your Product\ОЮј«У°Тф°ІЧ°іМРт.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\-8670_2508_mm.lnk
- %PROGRAM_FILES%\Your Product\qrgxdr_70739.exe
- %PROGRAM_FILES%\Your Product\setup_open_4705-2508.exe
- %PROGRAM_FILES%\Your Product\-8670_2508_mm.exe
- %PROGRAM_FILES%\Your Product\pczh_107_2508.exe
- %PROGRAM_FILES%\Your Product\setup_194a_p.exe
- %TEMP%\nsh6.tmp\NSISdl.dll
- %PROGRAM_FILES%\wjplay2\20140709231037\Data\loading.gif
- %PROGRAM_FILES%\wjplay2\20140709231037\Data\err.jpg
- %PROGRAM_FILES%\wjplay2\20140709231037\Data\tab_more.png
- %PROGRAM_FILES%\wjplay2\20140709231037\Data\poptime_bg.png
- %TEMP%\nsf9.tmp\BDMNetGetInfo.dll
- %PROGRAM_FILES%\广告神盾\BugReport.dll
- %PROGRAM_FILES%\meinvying\mvyy.exe
- %PROGRAM_FILES%\meinvying\uninst.exe
- %PROGRAM_FILES%\wjplay2\20140709231037\Data\Err.html
- %PROGRAM_FILES%\wjplay2\20140709231037\Data\User2.ini
- %TEMP%\nsvC.tmp\BDMNetGetInfo.dll
- %PROGRAM_FILES%\wjplay2\20140709231037\playlist.xml
- %PROGRAM_FILES%\wjplay2\20140709231037\stat.ini
- %PROGRAM_FILES%\wjplay2\20140709231037\server.ini
- %TEMP%\nsf9.tmp\tmpi7flio.dll
- %PROGRAM_FILES%\wjplay2\20140709231037\DuiLib.dll
- %PROGRAM_FILES%\wjplay2\20140709231037\Data\wj.ico
- %PROGRAM_FILES%\wjplay2\20140709231037\PlayerUpdate.exe
- %PROGRAM_FILES%\wjplay2\20140709231037\locallist.xml
- %PROGRAM_FILES%\广告神盾\adclear.bat
- %TEMP%\nsvC.tmp\dl.dll
- %PROGRAM_FILES%\广告神盾\adhkdll.dll
- %TEMP%\nsf9.tmp\hu.dll
- %TEMP%\nsf9.tmp\dl.dll
- %APPDATA%\FwNetwork\广告神盾\uninstall.exe
- %APPDATA%\FwNetwork\广告神盾\setup.ini
- %TEMP%\nsvC.tmp\BDMDownload.dll
- %TEMP%\nsf9.tmp\BDMDownload.dll
- %TEMP%\nsf9.tmp\BDLogicUtils.dll
- %PROGRAM_FILES%\wjplay2\20140709231037\Data\Def.html
- %PROGRAM_FILES%\meinvying\meinvying.exe
- %PROGRAM_FILES%\wjplay2\20140709231037\Data\EKanR.dat
- %PROGRAM_FILES%\wjplay2\20140709231037\Data\def.jpg
- %PROGRAM_FILES%\wjplay2\20140709231037\client.ini
- %PROGRAM_FILES%\广告神盾\AdShield.exe
- %TEMP%\nsvC.tmp\hu.dll
- %PROGRAM_FILES%\wjplay2\20140709231037\bottom.xml
- %TEMP%\nsvC.tmp\BDLogicUtils.dll
Deletes the following files:
- %TEMP%\nsm5.tmp\meinvying.exe
- %TEMP%\nsm5.tmp\System.dll
- %HOMEPATH%\Templates\920147231032640\YYM_955WD30.gif
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
Network activity:
Connects to:
- 'localhost':1051
- 'localhost':1055
- 'up####.aiqingzhihui.com':80
- '<Private IP address>':445
- 'localhost':1037
TCP:
HTTP GET requests:
- up####.aiqingzhihui.com/0403/help1.html
UDP:
- DNS ASK wj.#uji.com
- DNS ASK tj.#uji.com
- DNS ASK we#.##invying.net
- DNS ASK tj#.##invying.net
- DNS ASK p.#.#aidu.com
- DNS ASK xu#.###ogin2.tenpay.com
- DNS ASK up####.aiqingzhihui.com
- DNS ASK www.go#####analytics.com
- DNS ASK rp.#v.cc
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'TFormHuodongMini' WindowName: '(null)'
- ClassName: 'TFormLoginTips' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'WujiPlayer' WindowName: '????????'
- ClassName: '#32770' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'TFormTips' WindowName: '(null)'
- ClassName: 'OnLineWnd' WindowName: '(null)'
- ClassName: 'BDMOnLineWnd' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '#32770' WindowName: '????'
- ClassName: 'TFormMini' WindowName: '(null)'
- ClassName: 'THtmFormShow' WindowName: '(null)'
- ClassName: 'TMeiNvYMainForm' WindowName: '(null)'
