Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Creates and executes the following:
- %PROGRAM_FILES%\Internet Explorer\zh2.exe
- %PROGRAM_FILES%\Intarnet Explorer\navi.exe
- %PROGRAM_FILES%\Internet Explorer\iedv.EXE
- %PROGRAM_FILES%\Internet Explorer\nav.exe
Executes the following:
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.url"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.lnk"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\╠╘▒ж╚╚┬Ї.url"
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Intarnet Exqlorer.lnk" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Intarnet Explorer.lnk" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internat Explorer.lnk" /G everyone:R
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\╠╘▒ж╚╚┬Ї.lnk"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\╦╤╣╖╥╗╧┬.lnk"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\═°╥╫--╙╨╡└╦╤╦ў.lnk"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\░┘╢╚╦╤╦ў.url"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\╦╤╣╖╥╗╧┬.url"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\═°╥╫--╙╨╡└╦╤╦ў.url"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\╠╘▒ж.url"
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\╠╘▒ж╚╚┬Ї.url" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\╦╤╣╖╥╗╧┬.url" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\═°╥╫--╙╨╡└╦╤╦ў.url" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.lnk" /G everyone:R
- <SYSTEM32>\wbem\wmic.exe process where "name='winlogon.exe' and ExecutablePath<>'C:\\WINDOWS\\system32\\winlogon.exe'" call Terminate
- <SYSTEM32>\wbem\wmic.exe process where "name='smss.exe' and ExecutablePath<>'C:\\WINDOWS\\system32\\smss.exe'" call Terminate
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.url" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\═°╥╫--╙╨╡└╦╤╦ў.lnk" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\╠╘▒ж.lnk" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\░┘╢╚╦╤╦ў.lnk" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\╦╤╣╖╥╗╧┬.lnk" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\╠╘▒ж.url" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\░┘╢╚╦╤╦ў.url" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\╠╘▒ж╚╚┬Ї.lnk" /G everyone:R
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch" /T /G everyone:F
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop" /T /G everyone:F
- <SYSTEM32>\wscript.exe "%PROGRAM_FILES%\Internet Explorer\file.vbs"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\░┘╢╚╦╤╦ў.lnk"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\╦╤╣╖╥╗╧┬.lnk"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\═°╥╫--╙╨╡└╦╤╦ў.lnk"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\╠╘▒ж.lnk"
- <SYSTEM32>\reg.exe DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BROWSER HELPER OBJECTS" /f
- <SYSTEM32>\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Desktop"
- <SYSTEM32>\cmd.exe /c ""%TEMP%\22FA.CMD" "
- <SYSTEM32>\reg.exe DELETE "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks" /f
- <SYSTEM32>\regini.exe tmp.ini
- <SYSTEM32>\reg.exe ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks" /f
- <SYSTEM32>\reg.exe ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BROWSER HELPER OBJECTS" /f
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch" /T /G everyone:R
- <SYSTEM32>\wscript.exe "%PROGRAM_FILES%\Internet Explorer\tmp.vbs"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.url"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\Internet Explorer.lnk"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\╠╘▒ж.lnk"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\░┘╢╚╦╤╦ў.lnk"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\Internat Explorer.lnk"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\╠╘▒ж.url"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\░┘╢╚╦╤╦ў.url"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\╠╘▒ж╚╚┬Ї.lnk"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\═°╥╫--╙╨╡└╦╤╦ў.url"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.lnk"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\╠╘▒ж╚╚┬Ї.url"
- <SYSTEM32>\attrib.exe -h -r "%HOMEPATH%\Desktop\╦╤╣╖╥╗╧┬.url"
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Intarnet Exqlorer.lnk
- %TEMP%\tmp1.tmp
- %HOMEPATH%\Desktop\Intarnet Exqlorer.lnk
- %PROGRAM_FILES%\Internet Explorer\file.vbs
- %PROGRAM_FILES%\Internet Explorer\tmp.vbs
- <SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
- %PROGRAM_FILES%\Internet Explorer\TempWmicBatchFile.bat
- %TEMP%\tmp3.tmp
- %TEMP%\tmp2.tmp
- <SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
- %PROGRAM_FILES%\Internet Explorer\tmp.ini
- %PROGRAM_FILES%\Internet Explorer\nav.exe
- %PROGRAM_FILES%\Internet Explorer\zh2.exe
- %PROGRAM_FILES%\Internet Explorer\config.ini
- %PROGRAM_FILES%\Internet Explorer\IEXPL0RE.exe
- %PROGRAM_FILES%\Internet Explorer\ieconfig.ini
- %PROGRAM_FILES%\Intarnet Explorer\navi.exe
- %TEMP%\process_name.dat
- %PROGRAM_FILES%\Intarnet Explorer\config.ini
- %PROGRAM_FILES%\Internet Explorer\iedv.EXE
- %TEMP%\22FA.CMD
Sets the 'hidden' attribute to the following files:
- %PROGRAM_FILES%\Internet Explorer\iedv.EXE
- %PROGRAM_FILES%\Internet Explorer\config.ini
- %PROGRAM_FILES%\Internet Explorer\ieconfig.ini
Deletes the following files:
- %TEMP%\tmp3.tmp
- %TEMP%\tmp2.tmp
- %TEMP%\22FA.CMD
- %PROGRAM_FILES%\Internet Explorer\TempWmicBatchFile.bat
- %PROGRAM_FILES%\Internet Explorer\file.vbs
- %PROGRAM_FILES%\Internet Explorer\tmp.ini
- %TEMP%\tmp1.tmp
- %PROGRAM_FILES%\Internet Explorer\tmp.vbs
Network activity:
Connects to:
- '11#.#8.65.29':8383
- 'ga##.#9841983.com':8383
- 'ge#.#k2012.info':8383
- 'ge#.##owan365.com':8383
- 'ge#.#cdogs.info':8383
- 'up#.#hegfw.net':8901
- 'up#.#hegfw.net':8900
- 'up#.#hegfw.net':8902
- 'www.ba##u.com':80
- 'localhost':1041
UDP:
- DNS ASK ge#.#k2012.info
- DNS ASK ge#.#cdogs.info
- DNS ASK ge#.##owan365.com
- DNS ASK ga##.#9841983.com
- DNS ASK up#.#hegfw.net
- DNS ASK www.ba##u.com
- '25#.#55.255.255':8484
- '22#.0.0.1':37777
Miscellaneous:
Searches for the following windows:
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
