Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'EC5.exe' = '%PROGRAM_FILES%\LP\3AC8\EC5.exe'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\LP\3AC8\2.tmp
Executes the following:
- <SYSTEM32>\msiexec.exe /V
Modifies settings of Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnZoneCrossing' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:55939'
- [<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPost' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPost' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnZoneCrossing' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1407' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2301' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ua[1].php
- %PROGRAM_FILES%\LP\3AC8\1.exe
- %PROGRAM_FILES%\LP\3AC8\3.exe
- %PROGRAM_FILES%\LP\3AC8\2.tmp
- %APPDATA%\88E66\680F.8E6
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\A44F4E7CB3133FF765C39A53AD8FCFDD
- %PROGRAM_FILES%\LP\3AC8\EC5.exe
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\A44F4E7CB3133FF765C39A53AD8FCFDD
Deletes the following files:
- %PROGRAM_FILES%\LP\3AC8\3.exe
- %PROGRAM_FILES%\LP\3AC8\1.exe
Network activity:
Connects to:
- 'tr#####sdataforme.com':80
- 'cl.###oli-sys.com':80
- 'localhost':55939
- '74.##5.232.51':80
- 'cl.###ediastore.com':443
- 'xp###ats.com':80
- 'al######tionalsoftware.com':80
- '20#.#6.232.182':80
- 'wp#d':80
- 'localhost':1043
- 'cl.#####torageforyou.com':80
- 'cl.####ediahosts.com':80
TCP:
HTTP GET requests:
- xp###ats.com/k1.php?tq###########################################################################################################################################################
- cl.#####torageforyou.com/logo.png?sv########################################################################################
- cl.###oli-sys.com/logo.png?sv########################################################################################
- xp###ats.com/k1.php?tq#########################################################################################################################################################
- cl.#####torageforyou.com/img/135.png?sv######################################################################################################################################################################################################
- xp###ats.com/images/logo.png?tq###########################################################################################################################################################################################
- 74.##5.232.51/
- 20#.#6.232.182/pki/crl/products/CodeSignPCA2.crl
- 20#.#6.232.182/pki/crl/products/CSPCA.crl
- wp#d/wpad.dat
- al######tionalsoftware.com/creditcardlogos.gif?sv##################################################
- cl.####ediahosts.com/g/ua.php?tq#################################
- cl.#####torageforyou.com/logo.png?tq#################################
- cl.####ediahosts.com/logo.png?sv########################################################################
UDP:
- DNS ASK TR#####SDATAFORME.COM
- DNS ASK cl.###oli-sys.com
- DNS ASK xp###ats.com
- DNS ASK www.google.com
- DNS ASK cl.###ediastore.com
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
- DNS ASK al######tionalsoftware.com
- DNS ASK cl.#####torageforyou.com
- DNS ASK cl.####ediahosts.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
