Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'ctfmon' = '<SYSTEM32>\ctfmon.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xyxy' = 'C:\Users\Administrator\AppData\Roaming\xyxy\xyxy.exe -run:23'
- [<HKLM>\Software\Classes\http\shell\open\command] '' = '"%ProgramFiles%\Internet Explorer\IEXPLORE.EXE" -nohome'
- [<HKLM>\Software\Classes\https\shell\open\command] '' = '"%ProgramFiles%\Internet Explorer\IEXPLORE.EXE" -nohome'
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\aut1e86.tmp
- %APPDATA%\sogouexplorer\favorite3.dat
- %TEMP%\aut2c2f.tmp
- %APPDATA%\360se6\user data\default\bookmarks
- %TEMP%\aut2c3f.tmp
- %TEMP%\aut2c40.tmp
- %APPDATA%\maxthon5\users\guest\molebox\molebox.dat
- %TEMP%\aut2c51.tmp
- %APPDATA%\mozilla\firefox\profiles\xw1mz5my.default-release\places.sqlite
- %TEMP%\aut2cee.tmp
- %TEMP%\aut2cef.tmp
- %TEMP%\aut2cf0.tmp
- %TEMP%\aut2d01.tmp
- %TEMP%\aut2d11.tmp
- %TEMP%\aut2d12.tmp
- %TEMP%\aut2d34.tmp
- %APPDATA%\360se6\application\components\sesvc
- %TEMP%\aut2d35.tmp
- %TEMP%\aut2d36.tmp
- %TEMP%\aut2d46.tmp
- %TEMP%\aut2d47.tmp
- %TEMP%\aut2d58.tmp
- %TEMP%\aut2d68.tmp
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\config bookmarks
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\config bookmarks.zip
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\favicons
- %LOCALAPPDATA%\2345explorer\user data\default\faviconsv3
- C:\users\public\desktop\internet explorer.lnk
- %LOCALAPPDATA%\microsoft\windows\themes\custom.theme
- %LOCALAPPDATA%\tencent\qqbrowser\user data\liveup
- %APPDATA%\kuaiya
- %TEMP%\aut2c1e.tmp
- %TEMP%\aut2d23.tmp
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\bookmarks
- %HOMEPATH%\favorites\links\优品购物.url
- %APPDATA%\mozilla\firefox\profiles\installs.ini
- %TEMP%\aut1e97.tmp
- %APPDATA%\mozilla\firefox\profiles\profiles.ini
- %HOMEPATH%\favorites\links\360借条.url
- %HOMEPATH%\favorites\links\爱淘宝.url
- %HOMEPATH%\favorites\links\百度一下.url
- %HOMEPATH%\favorites\links\成人用品.url
- %HOMEPATH%\favorites\links\京东商城.url
- %HOMEPATH%\favorites\links\聚划算.url
- %HOMEPATH%\favorites\links\拼多多.url
- %HOMEPATH%\favorites\links\苏宁易购.url
- %HOMEPATH%\favorites\links\天猫商城.url
- %HOMEPATH%\favorites\links\网络游戏.url
- %HOMEPATH%\favorites\links\网址导航.url
- %HOMEPATH%\favorites\links\唯品会.url
- %LOCALAPPDATA%\2345explorer\user data\default\bookmarksv3
- %TEMP%\aut2bc7.tmp
- %LOCALAPPDATA%\theworld6\user data\default\bookmarks
- %TEMP%\aut2bc8.tmp
- %LOCALAPPDATA%\ucbrowser\user data\default\bookmarks
- %TEMP%\aut2bd8.tmp
- %LOCALAPPDATA%\2345explorer\user data\default\bookmarks
- %TEMP%\aut2bd9.tmp
- %LOCALAPPDATA%\google\chrome\user data\default\bookmarks
- %TEMP%\aut2bea.tmp
- %TEMP%\aut2beb.tmp
- %LOCALAPPDATA%\360chrome\chrome\user data\default\bookmarks
- %TEMP%\aut2bfc.tmp
- %LOCALAPPDATA%\2345explorer\user data\default\bookmarksv2
- %TEMP%\aut2c0c.tmp
- %TEMP%\aut2c0d.tmp
- %HOMEPATH%\desktop\电脑微信.lnk
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\config bookmarks
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\config bookmarks.zip
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\favicons
- %LOCALAPPDATA%\2345explorer\user data\default\faviconsv3
- %LOCALAPPDATA%\tencent\qqbrowser\user data\liveup
- %APPDATA%\kuaiya
- %APPDATA%\360se6\application\components\sesvc
- %HOMEPATH%\desktop\电脑微信.lnk
Deletes the following files
- %TEMP%\aut1e86.tmp
- %TEMP%\aut2d68.tmp
- %TEMP%\aut2d58.tmp
- %TEMP%\aut2d47.tmp
- %TEMP%\aut2d46.tmp
- %TEMP%\aut2d36.tmp
- %TEMP%\aut2d35.tmp
- %TEMP%\aut2d34.tmp
- %TEMP%\aut2d23.tmp
- %TEMP%\aut2d12.tmp
- %TEMP%\aut2d11.tmp
- %TEMP%\aut2d01.tmp
- %TEMP%\aut2cf0.tmp
- %TEMP%\aut2cef.tmp
- %TEMP%\aut2cee.tmp
- %TEMP%\aut2c51.tmp
- %TEMP%\aut2c40.tmp
- %TEMP%\aut2c3f.tmp
- %TEMP%\aut2c2f.tmp
- %TEMP%\aut2c1e.tmp
- %TEMP%\aut2c0d.tmp
- %TEMP%\aut2c0c.tmp
- %TEMP%\aut2bfc.tmp
- %TEMP%\aut2beb.tmp
- %TEMP%\aut2bea.tmp
- %TEMP%\aut2bd9.tmp
- %TEMP%\aut2bd8.tmp
- %TEMP%\aut2bc8.tmp
- %TEMP%\aut2bc7.tmp
- %TEMP%\aut1e97.tmp
- %WINDIR%\tasks\adobe flash player updater.job
- <SYSTEM32>\tasks\adobe flash player updater
Deletes itself.
Miscellaneous
Searches for the following windows
- ClassName: 'PersonalizationThemeChangeListener' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C powercfg -x -monitor-timeout-ac 0' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C powercfg -change -standby-timeout-ac 0' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Roaming\IQIYI Video\LStyle\QyUpdate" /deny system:(F) /inheritance:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Roaming\Tencent\QQLive\CacheFile" /deny system:(F) /inheritance:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Local\Tencent\QQBrowser\User Data\Liveup" /deny system:(F) /inheritance:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C icacls "%ProgramFiles%\Thunder Network\Thunder\Data\ThunderPush" /deny system:(F) /inheritance:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C icacls "%ProgramFiles(x86)%\Thunder Network\Thunder\Data\ThunderPush" /deny system:(F) /inheritance:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Roaming\kuaiya" /deny system:(F) /inheritance:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Roaming\快压\X86\Update.exe" /deny system:(F) /inheritance:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Roaming\360se6\Application\components\sesvc" /deny system:(F) /inheritance:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\Desktop\电脑微信.lnk" /deny system:(F) /inheritance:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C powercfg -x -monitor-timeout-ac 0
- '%WINDIR%\syswow64\icacls.exe' "C:\Users\Administrator\Desktop\电脑微信.lnk" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\Desktop\电脑微信.lnk" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\icacls.exe' "C:\Users\Administrator\AppData\Roaming\360se6\Application\components\sesvc" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Roaming\360se6\Application\components\sesvc" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\icacls.exe' "C:\Users\Administrator\AppData\Roaming\快压\X86\Update.exe" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Roaming\快压\X86\Update.exe" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\icacls.exe' "C:\Users\Administrator\AppData\Roaming\kuaiya" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Roaming\kuaiya" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\icacls.exe' "%ProgramFiles(x86)%\Thunder Network\Thunder\Data\ThunderPush" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\cmd.exe' /C icacls "%ProgramFiles(x86)%\Thunder Network\Thunder\Data\ThunderPush" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Full path to file>"
- '%WINDIR%\syswow64\icacls.exe' "%ProgramFiles%\Thunder Network\Thunder\Data\ThunderPush" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\icacls.exe' "C:\Users\Administrator\AppData\Local\Tencent\QQBrowser\User Data\Liveup" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Local\Tencent\QQBrowser\User Data\Liveup" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\icacls.exe' "C:\Users\Administrator\AppData\Roaming\Tencent\QQLive\CacheFile" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Roaming\Tencent\QQLive\CacheFile" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\icacls.exe' "C:\Users\Administrator\AppData\Roaming\IQIYI Video\LStyle\QyUpdate" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\cmd.exe' /C icacls "C:\Users\Administrator\AppData\Roaming\IQIYI Video\LStyle\QyUpdate" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\shell32.dll,Control_RunDLL <SYSTEM32>\desk.cpl desk,@Themes /Action:OpenTheme /file:"%WINDIR%\Resources\Themes\aero.theme"
- '%WINDIR%\syswow64\powercfg.exe' -change -standby-timeout-ac 0
- '%WINDIR%\syswow64\cmd.exe' /C powercfg -change -standby-timeout-ac 0
- '%WINDIR%\syswow64\powercfg.exe' -x -monitor-timeout-ac 0
- '%WINDIR%\syswow64\cmd.exe' /C icacls "%ProgramFiles%\Thunder Network\Thunder\Data\ThunderPush" /deny system:(F) /inheritance:r
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
