Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] ' ISSetupPrerequisistes' = '"<Full path to file>"'
Malicious functions:
Executes the following:
- '%TEMP%\InstallAX.exe' -install activex -msi
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\{36F51CF6-67F3-4040-AB70-7E414A535177}\default.msi" SETUPEXEDIR="<Current directory>" SETUPEXENAME="<File name>.exe"
- '<SYSTEM32>\msiexec.exe' -Embedding 27B7D099539FDF15C0F4D7222E897DDC
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\{36F51CF6-67F3-4040-AB70-7E414A535177}\{DE854B54-0D57-4FCB-B22A-3CCF690B5E47}\install_flash_player_10_active_x.msi" /qn
- '<SYSTEM32>\msiexec.exe' /V
Modifies file system:
Creates the following files:
- %TEMP%\B.tmp
- %TEMP%\InstallAX.exe
- <SYSTEM32>\Macromed\Flash\Flash10h.ocx
- %TEMP%\A.tmp
- %TEMP%\~DF8E65.tmp
- %WINDIR%\Installer\22a15.ipi
- C:\Config.Msi\22a16.rbs
- %WINDIR%\Installer\MSI8.tmp
- <SYSTEM32>\Macromed\Flash\FlashUtil10h_ActiveX.exe
- %TEMP%\_isD.tmp
- %TEMP%\~DF4920.tmp
- %TEMP%\2fa54.msi
- %TEMP%\{36F51CF6-67F3-4040-AB70-7E414A535177}\default.msi
- <SYSTEM32>\Macromed\Flash\FlashInstall.log
- <SYSTEM32>\Macromed\Flash\FlashUtil10h_ActiveX.dll
- %WINDIR%\Installer\{FFB768E4-E427-4553-BC36-A11F5E62A94D}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\22a17.msi
- %WINDIR%\Installer\MSI7.tmp
- %TEMP%\_is4.tmp
- %TEMP%\{36F51CF6-67F3-4040-AB70-7E414A535177}\0x040a.ini
- %TEMP%\_is5.tmp
- %TEMP%\~3.tmp
- %TEMP%\{36F51CF6-67F3-4040-AB70-7E414A535177}\Setup.INI
- %TEMP%\_is1.tmp
- %TEMP%\_is2.tmp
- %TEMP%\{36F51CF6-67F3-4040-AB70-7E414A535177}\_ISMSIDEL.INI
- %TEMP%\{36F51CF6-67F3-4040-AB70-7E414A535177}\Flash 10.prq
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\0797C381B2F87EB5A1D5573BD15BA4F4
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\0797C381B2F87EB5A1D5573BD15BA4F4
- %WINDIR%\Installer\22a13.msi
- %TEMP%\MSI22476.LOG
- %TEMP%\{36F51CF6-67F3-4040-AB70-7E414A535177}\{DE854B54-0D57-4FCB-B22A-3CCF690B5E47}\install_flash_player_10_active_x.msi
- %TEMP%\_is6.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
Deletes the following files:
- %WINDIR%\Installer\MSI8.tmp
- %TEMP%\A.tmp
- <SYSTEM32>\Macromed\Flash\flash.ocx
- C:\Config.Msi\22a16.rbs
- %TEMP%\_isD.tmp
- %WINDIR%\Installer\22a15.ipi
- %WINDIR%\Installer\22a13.msi
- %TEMP%\B.tmp
- %TEMP%\_is4.tmp
- %TEMP%\_is2.tmp
- %TEMP%\_is1.tmp
- %TEMP%\~3.tmp
- %WINDIR%\Installer\MSI7.tmp
- %TEMP%\_is6.tmp
- %TEMP%\_is5.tmp
Network activity:
Connects to:
- 'cs#######-2-crl.verisign.com':80
- 'crl.verisign.com':80
- 'wp#d':80
TCP:
HTTP GET requests:
- http://cs#######-2-crl.verisign.com/CSC3-2009-2.crl
- http://crl.verisign.com/pca3.crl
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK cs#######-2-crl.verisign.com
- DNS ASK crl.verisign.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
