Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskhost.exe' /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Modifies file system :
Creates the following files:
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\bullet[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\info_48[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\dnserror[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\background_gradient[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\ErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\navcancl[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\errorPageStrings[2]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\dnserrordiagoff[2]
- <LS_APPDATA>\Microsoft\Internet Explorer\imagestore\g1bfg6d\imagestore.dat
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\NewErrorPageTemplate[2]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\httpErrorPagesScripts[2]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\errorPageStrings[1]
- %APPDATA%\Roaming\Microsoft\Protect\S-1-5-21-2832440558-3064306045-1455513625-1000\3fc4006a-43f3-4ba3-939b-47ba109a47b4
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\dnserrordiagoff[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\dnserrordiagoff[1]
- %TEMP%\~DFCE87C4D5F6CA7CEA.TMP
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\NewErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\dnserrordiagoff[1]
- <LS_APPDATA>\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E244E012-FA52-11E4-9406-DF274D05C8F2}.dat
- %TEMP%\~DF88C1AF7E3414BE9B.TMP
- <LS_APPDATA>\Microsoft\Internet Explorer\Recovery\High\Active\{E244E014-FA52-11E4-9406-DF274D05C8F2}.dat
- %TEMP%\~DF87C70715B7E6405C.TMP
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\NewErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\httpErrorPagesScripts[2]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\errorPageStrings[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\errorPageStrings[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\NewErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\errorPageStrings[1]
Deletes the following files:
- <DRIVERS>\etc\hosts
Network activity:
UDP:
- DNS ASK ba######3.googlecode.com
- DNS ASK ie#####t.microsoft.com
- DNS ASK ie#####e.microsoft.com
- DNS ASK dn#.##ftncsi.com
- DNS ASK go.###rosoft.com
- DNS ASK ad#.ly
- DNS ASK fa###.blackhack.pro
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: '#32770' WindowName: 'iexplore.exe - Application Error'
- ClassName: 'Shell Embedding' WindowName: ''
- ClassName: 'Internet Explorer_Server' WindowName: ''
- ClassName: 'Shell DocObject View' WindowName: ''
- ClassName: '#32770' WindowName: 'Internet Explorer'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: '#32770' WindowName: 'Web Browser'
- ClassName: '#32770' WindowName: 'Windows Internet Explorer'
