Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DS_Tray_Spirit' = 'C:\DSOA\DS_Tray_Spirit20140829all.exe'
Malicious functions:
Executes the following:
- 'C:\DSOA\DS_Tray_Spirit20140829all.exe' local
- 'C:\DSOA\MySetTrustZone.exe' local
- '%TEMP%\is-PBPCJ.tmp\is-30IK5.tmp' /SL4 $30092 "<Full path to file>" 726439 51200
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1806' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2000' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A04' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1802' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1800' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1804' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1803' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2102' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2101' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2100' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1402' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1606' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1604' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1608' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1607' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1601' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1407' = '00000000'
Modifies file system:
Creates the following files:
- C:\DSOA\is-OJF8O.tmp
- C:\DSOA\is-ENFNL.tmp
- C:\DSOA\is-SG3QH.tmp
- C:\DSOA\is-4FGR7.tmp
- C:\DSOA\is-ULH8D.tmp
- C:\DSOA\is-DB7V0.tmp
- C:\DSOA\is-UB4C5.tmp
- C:\DSOA\is-B2923.tmp
- C:\DSOA\url.ini
- C:\DSOA\dsoa.url
- C:\DSOA\DS_Tray_Spirit_Log\2016-10-16_%USERNAME%.log
- C:\DSOA\unins000.dat
- C:\DSOA\is-IHF63.tmp
- C:\DSOA\is-V9HHD.tmp
- C:\DSOA\is-ITNU9.tmp
- C:\DSOA\is-UQKGH.tmp
- C:\DSOA\is-IPQG0.tmp
- C:\DSOA\is-88JVU.tmp
- C:\DSOA\is-T0LNS.tmp
- C:\DSOA\is-2PRI8.tmp
- %TEMP%\is-PBPCJ.tmp\is-30IK5.tmp
- %TEMP%\is-CQM9I.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-CQM9I.tmp\_isetup\_shfoldr.dll
- C:\DSOA\is-2FHOQ.tmp
- C:\DSOA\is-0TDFB.tmp
- C:\DSOA\is-EJRQL.tmp
- C:\DSOA\is-2L9JD.tmp
- C:\DSOA\is-RUTNB.tmp
- C:\DSOA\is-2S6BP.tmp
- C:\DSOA\is-OSVHS.tmp
- C:\DSOA\is-OO0KJ.tmp
Deletes the following files:
- %TEMP%\is-CQM9I.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-PBPCJ.tmp\is-30IK5.tmp
- C:\DSOA\unins000.exe
- %TEMP%\is-CQM9I.tmp\_isetup\_RegDLL.tmp
Moves the following files:
- from C:\DSOA\is-UB4C5.tmp to C:\DSOA\Scancontrol.ini
- from C:\DSOA\is-4FGR7.tmp to C:\DSOA\seal.ini
- from C:\DSOA\is-DB7V0.tmp to C:\DSOA\MySetTrustZone.exe
- from C:\DSOA\is-UQKGH.tmp to C:\DSOA\dsoa.url
- from C:\DSOA\is-ULH8D.tmp to C:\DSOA\DS_Tray_Spirit20140829all.exe
- from C:\DSOA\is-OJF8O.tmp to C:\DSOA\sy_emptyseal.bmp
- from C:\DSOA\is-V9HHD.tmp to C:\DSOA\wdzx97wps.dot
- from C:\DSOA\is-ITNU9.tmp to C:\DSOA\webserver.ini
- from C:\DSOA\is-IHF63.tmp to C:\DSOA\wdzx97.dot
- from C:\DSOA\is-ENFNL.tmp to C:\DSOA\unins000.dat
- from C:\DSOA\is-B2923.tmp to C:\DSOA\url.ini
- from C:\DSOA\is-2L9JD.tmp to C:\DSOA\dsoa.ico
- from C:\DSOA\is-T0LNS.tmp to C:\DSOA\1.jpg
- from C:\DSOA\is-2FHOQ.tmp to C:\DSOA\1.wav
- from C:\DSOA\is-88JVU.tmp to C:\DSOA\0.wav
- from C:\DSOA\is-2PRI8.tmp to C:\DSOA\unins000.exe
- from C:\DSOA\is-IPQG0.tmp to C:\DSOA\0.jpg
- from C:\DSOA\is-2S6BP.tmp to C:\DSOA\2.jpg
- from C:\DSOA\is-0TDFB.tmp to C:\DSOA\dot0.ico
- from C:\DSOA\is-EJRQL.tmp to C:\DSOA\dot1.ico
- from C:\DSOA\is-RUTNB.tmp to C:\DSOA\3.wav
- from C:\DSOA\is-OSVHS.tmp to C:\DSOA\2.wav
- from C:\DSOA\is-OO0KJ.tmp to C:\DSOA\3.jpg
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
