Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\At7.job
- %WINDIR%\Tasks\At6.job
- %WINDIR%\Tasks\At9.job
- %WINDIR%\Tasks\At8.job
- %WINDIR%\Tasks\At5.job
- %WINDIR%\Tasks\At2.job
- %WINDIR%\Tasks\At1.job
- %WINDIR%\Tasks\At4.job
- %WINDIR%\Tasks\At3.job
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Executes the following:
- '<SYSTEM32>\at.exe' 10:41 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%CommonProgramFiles%\Microsoft Shared\Speech\sapisvrs.exe"
- '<SYSTEM32>\at.exe' 6:32 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%ProgramFiles%\Internet Explorer\iexplorer.exe"
- '<SYSTEM32>\cmd.exe' /c copy "%APPDATA%\microsoft\installer\{caf09671-e1ba-4d99-b6ef-912562bf8086}\ieinstaller.exe" "%CommonProgramFiles%\Microsoft Shared\Speech\sapisvrs.exe"
- '<SYSTEM32>\at.exe' 8:39 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32s.exe"
- '<SYSTEM32>\at.exe' 3:34 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%ProgramFiles%\FireFox\update.exe"
- '%TEMP%\updatems.exe' /n
- '<SYSTEM32>\at.exe' 6:37 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%TEMP%\updatems.exe"
- '<SYSTEM32>\at.exe' 6:30 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%TEMP%\updatems.exe"
- '<SYSTEM32>\cmd.exe' /c copy "%APPDATA%\microsoft\installer\{caf09671-e1ba-4d99-b6ef-912562bf8086}\ieinstaller.exe" "%ProgramFiles%\Movie Maker\moviemks.exe"
- '<SYSTEM32>\at.exe' 12:43 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%ProgramFiles%\Movie Maker\moviemks.exe"
- '<SYSTEM32>\reg.exe' add hklm\software\microsoft\windows\currentversion\policies\system /v consentpromptbehavioradmin /t reg_dword /d 0 /f
- '<SYSTEM32>\cmd.exe' /c copy "%APPDATA%\microsoft\installer\{caf09671-e1ba-4d99-b6ef-912562bf8086}\ieinstaller.exe" "%APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstallers.exe"
- '<SYSTEM32>\reg.exe' add hklm\software\microsoft\windows\currentversion\policies\system /v enablelua /t reg_dword /d 0x0 /f
- '%APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstaller.exe'
- '%TEMP%\fourthofjulyss.exe'
- '<SYSTEM32>\at.exe' 5:36 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%CommonProgramFiles%\Microsoft Shared\DW\DW20s.exe"
- '<SYSTEM32>\cmd.exe' /c copy "%APPDATA%\microsoft\installer\{caf09671-e1ba-4d99-b6ef-912562bf8086}\ieinstaller.exe" "%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32s.exe"
- '%TEMP%\fourthofjulyss.exe' /wrapper /dir="%TEMP%\pkg_625b1e40" /pproc="<File name>.exe"
- '<SYSTEM32>\at.exe' 6:37 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstallers.exe"
- '<SYSTEM32>\cmd.exe' /c copy "%APPDATA%\microsoft\installer\{caf09671-e1ba-4d99-b6ef-912562bf8086}\ieinstaller.exe" "%CommonProgramFiles%\Microsoft Shared\DW\DW20s.exe"
Installs hooks to intercept notifications
on keystrokes:
- Handler for the 'fourthofjulyss.exe' process: <SYSTEM32>\w1sv32e.dll
Modifies file system:
Creates the following files:
- %TEMP%\pkg_625b1e40\detectionrules.dat
- %ProgramFiles%\Internet Explorer\iexplorer.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\sapisvrs.exe
- %ProgramFiles%\FireFox\update.exe
- %ProgramFiles%\FireFox\RCX1.tmp
- <SYSTEM32>\w1sv32e.dll
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\configpublic96[1].dat
- %TEMP%\updatems.exe
- %ProgramFiles%\Internet Explorer\RCX2.tmp
- %ProgramFiles%\Movie Maker\moviemks.exe
- %TEMP%\pkg_625b1e40\wrapper.xml
- %TEMP%\pkg_625b1e40\autorun.txt
- %TEMP%\pkg_625b1e40\stub.log
- %APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstaller.exe
- %TEMP%\fourthofjulyss.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32s.exe
- %TEMP%\pkg_625b1e40\fourthofjulyss.log
- %CommonProgramFiles%\Microsoft Shared\DW\DW20s.exe
- %APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstallers.exe
- %TEMP%\pkg_625b1e40\timings.txt
Deletes the following files:
- %ProgramFiles%\Internet Explorer\iexplorer.exe
- %ProgramFiles%\FireFox\update.exe
Network activity:
Connects to:
- 'ma###.#0freehost.com':80
- 'sq####0.tripod.com':80
- 'na#####ammed.tripod.com':80
- 'localhost':1035
- 'dl.###talliq.com':80
TCP:
HTTP GET requests:
- http://ma###.#0freehost.com/configpublic96.dat
- http://sq####0.tripod.com/configpublic96.dat
- http://dl.###talliq.com/api/detectionrequest.aspx?ke############################################
- http://na#####ammed.tripod.com/configpublic96.dat
UDP:
- DNS ASK ma###.#0freehost.com
- DNS ASK sq####0.tripod.com
- DNS ASK dl.###talliq.com
- DNS ASK na#####ammed.tripod.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'tooltips_class32 ' WindowName: 'MCI command handling window'
- ClassName: 'Shell_TrayWnd' WindowName: ''
