Technical Information
Malicious functions:
Creates and executes the following:
- %TEMP%\nss3.tmp\ns10.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r %USERNAME%
- %TEMP%\nss3.tmp\ns11.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r %USERNAME%s
- %TEMP%\nss3.tmp\nsE.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /g everyone:r
- %TEMP%\nss3.tmp\nsF.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r users
- %TEMP%\nss3.tmp\ns12.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r system
- %TEMP%\nss3.tmp\ns15.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /g everyone:r
- %TEMP%\nss3.tmp\ns16.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r users
- %TEMP%\nss3.tmp\ns13.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r %USERNAME%
- %TEMP%\nss3.tmp\ns14.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r everyone
- %TEMP%\nss3.tmp\nsD.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r everyone
- %TEMP%\nss3.tmp\ns6.tmp regini.exe regini.ini
- %TEMP%\nss3.tmp\ns7.tmp cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /g everyone:f
- %TEMP%\nss3.tmp\ns4.tmp regini.exe bak.ini
- %TEMP%\nss3.tmp\ns5.tmp regedit.exe /s CHS.reg
- %TEMP%\nss3.tmp\ns8.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /g everyone:f
- %TEMP%\nss3.tmp\nsB.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r system
- %TEMP%\nss3.tmp\nsC.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r %USERNAME%
- %TEMP%\nss3.tmp\ns9.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r %USERNAME%
- %TEMP%\nss3.tmp\nsA.tmp cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r %USERNAME%s
Executes the following:
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r %USERNAME%
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r %USERNAME%s
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /g everyone:r
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r users
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /g everyone:r
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r users
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r system
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /r everyone
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r everyone
- <SYSTEM32>\regini.exe regini.ini
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /t /e /c /g everyone:f
- <SYSTEM32>\regini.exe bak.ini
- %WINDIR%\regedit.exe /s CHS.reg
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r %USERNAME%s
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r system
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /g everyone:f
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /t /e /c /r %USERNAME%
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\nss3.tmp\nsF.tmp
- %TEMP%\nss3.tmp\ns10.tmp
- %TEMP%\nss3.tmp\ns11.tmp
- %TEMP%\nss3.tmp\nsE.tmp
- %TEMP%\nss3.tmp\nsB.tmp
- %TEMP%\nss3.tmp\nsC.tmp
- %TEMP%\nss3.tmp\nsD.tmp
- %TEMP%\nss3.tmp\ns16.tmp
- %TEMP%\nss3.tmp\NSISdl.dll
- %HOMEPATH%\Desktop\IFoxInstall_3.2.0.0-c203099-s-x.exe
- %TEMP%\nss3.tmp\ns15.tmp
- %TEMP%\nss3.tmp\ns12.tmp
- %TEMP%\nss3.tmp\ns13.tmp
- %TEMP%\nss3.tmp\ns14.tmp
- %TEMP%\nss3.tmp\nsA.tmp
- <SYSTEM32>\bak.ini
- %TEMP%\nss3.tmp\nsExec.dll
- %TEMP%\nss3.tmp\ns4.tmp
- <SYSTEM32>\CHS.reg
- %TEMP%\nsx2.tmp
- %TEMP%\nss3.tmp\System.dll
- <SYSTEM32>\regini.ini
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
- %HOMEPATH%\Desktop\Internet Explorer.lnk
- %TEMP%\nss3.tmp\ns9.tmp
- %TEMP%\nss3.tmp\ns8.tmp
- %TEMP%\nss3.tmp\ns5.tmp
- %TEMP%\nss3.tmp\ns6.tmp
- %TEMP%\nss3.tmp\ns7.tmp
Deletes the following files:
- %TEMP%\nss3.tmp\ns10.tmp
- %TEMP%\nss3.tmp\ns11.tmp
- %TEMP%\nss3.tmp\nsF.tmp
- %TEMP%\nss3.tmp\nsD.tmp
- %TEMP%\nss3.tmp\nsE.tmp
- %TEMP%\nss3.tmp\ns15.tmp
- %TEMP%\nss3.tmp\ns16.tmp
- %TEMP%\nss3.tmp\ns14.tmp
- %TEMP%\nss3.tmp\ns12.tmp
- %TEMP%\nss3.tmp\ns13.tmp
- %TEMP%\nss3.tmp\nsC.tmp
- %TEMP%\nss3.tmp\ns6.tmp
- <SYSTEM32>\regini.ini
- %TEMP%\nss3.tmp\ns5.tmp
- %TEMP%\nss3.tmp\ns4.tmp
- <SYSTEM32>\bak.ini
- %TEMP%\nss3.tmp\nsA.tmp
- %TEMP%\nss3.tmp\nsB.tmp
- %TEMP%\nss3.tmp\ns9.tmp
- %TEMP%\nss3.tmp\ns7.tmp
- %TEMP%\nss3.tmp\ns8.tmp
Network activity:
Connects to:
- 'pc.##ima8.com':80
TCP:
HTTP GET requests:
- pc.##ima8.com/index.php?p=###################################################################
UDP:
- DNS ASK pc.##ima8.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
