Trojan.Inject4.33294

Added to the Dr.Web virus database: 2022-06-05

Virus description added: 2022-06-06

Malicious functions

Injects code into

the following user processes:

Modifies file system

Creates the following files

<Current directory>\quick 'n easy web builder 9 (64-bit)\registry.rw.tvr.lck.bntrrrchj.ffffffff.8e8
<Current directory>\quick 'n easy web builder 9 (64-bit)\registry.rw.tvr
<Current directory>\quick 'n easy web builder 9 (64-bit)\registry.rw.tvr.transact
<Current directory>\quick 'n easy web builder 9 (64-bit)\registry.tlog.cache
<Current directory>\quick 'n easy web builder 9 (64-bit)\dummytls\-2280.1456.tmp
<Current directory>\quick 'n easy web builder 9 (64-bit)\skel\cc745f941a0e49e66ea474f22039043e338ef609\qualityagent64.exe.8c4.a04
<Current directory>\quick 'n easy web builder 9 (64-bit)\skel\nqqpillnolhvqvimtpshkuriiohglgrqnipshsjg.tls-2564-2244.tls
<Current directory>\quick 'n easy web builder 9 (64-bit)\%local appdata%\microsoft\windows\<INETFILES>\content.ie5\index.dat
<Current directory>\quick 'n easy web builder 9 (64-bit)\%appdata%\microsoft\windows\cookies\index.dat
<Current directory>\quick 'n easy web builder 9 (64-bit)\%local appdata%\microsoft\windows\history\history.ie5\index.dat
<Current directory>\fonts\13b1eab65a983c7a73bc7997c479d66943f7c6cb\-2244.2564.tmp
<Current directory>\fonts\38ecfc3e05075a50a12196755d8996fe36ed01ea\-2244.2564.tmp
<Current directory>\quick 'n easy web builder 9 (64-bit)\registry.tlog

Sets the 'hidden' attribute to the following files

<Current directory>\quick 'n easy web builder 9 (64-bit)\%local appdata%\microsoft\windows\<INETFILES>\content.ie5\index.dat
<Current directory>\quick 'n easy web builder 9 (64-bit)\%appdata%\microsoft\windows\cookies\index.dat
<Current directory>\quick 'n easy web builder 9 (64-bit)\%local appdata%\microsoft\windows\history\history.ie5\index.dat

Moves the following files

from <Current directory>\quick 'n easy web builder 9 (64-bit)\registry.rw.tvr.lck.bntrrrchj.ffffffff.8e8 to <Current directory>\quick 'n easy web builder 9 (64-bit)\registry.rw.tvr.lck
from <Current directory>\quick 'n easy web builder 9 (64-bit)\dummytls\-2280.1456.tmp to <Current directory>\quick 'n easy web builder 9 (64-bit)\dummytls\dummytls.dll
from <Current directory>\quick 'n easy web builder 9 (64-bit)\skel\cc745f941a0e49e66ea474f22039043e338ef609\qualityagent64.exe.8c4.a04 to <Current directory>\quick 'n easy web builder 9 (64-bit)\skel\cc745f941a0e49e66ea474f22039043e338ef609\qualityagent64.exe
from <Current directory>\quick 'n easy web builder 9 (64-bit)\skel\nqqpillnolhvqvimtpshkuriiohglgrqnipshsjg.tls-2564-2244.tls to <Current directory>\quick 'n easy web builder 9 (64-bit)\skel\nqqpillnolhvqvimtpshkuriiohglgrqnipshsjg.tls
from <Current directory>\fonts\13b1eab65a983c7a73bc7997c479d66943f7c6cb\-2244.2564.tmp to <Current directory>\fonts\13b1eab65a983c7a73bc7997c479d66943f7c6cb\fontawesome-webfont.ttf
from <Current directory>\fonts\38ecfc3e05075a50a12196755d8996fe36ed01ea\-2244.2564.tmp to <Current directory>\fonts\38ecfc3e05075a50a12196755d8996fe36ed01ea\materialicons-regular.ttf

Substitutes the following files

<Current directory>\quick 'n easy web builder 9 (64-bit)\dummytls\-2280.1456.tmp

Network activity

Connects to

TCP

Other

UDP

Miscellaneous

Creates and executes the following

'<Current directory>\quick 'n easy web builder 9 (64-bit)\skel\cc745f941a0e49e66ea474f22039043e338ef609\qualityagent64.exe' -Report "Quick 'n Easy Web Builder 9 (64-bit)" "<Current directory>"