Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\asdffile\shell\open\command] '' = '"%CommonProgramFiles%\cgyguard.exe" "%1"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\NetTV.lnk
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\kingsoftv\KSWebShield.exe' -install
- '%TEMP%\is-KIECN.tmp\vip.tmp' /SL5="$100FC,912334,51712,%PROGRAM_FILES%\vip.exe" /sp- /silent /norestart /verysilent
- '%WINDIR%\kingsoftv\KSWebShield.exe' -start
- '%CommonProgramFiles%\FunshionInstall_C8776.exe'
- '%WINDIR%\kingsoftv\KSWebShield.exe'
- '%CommonProgramFiles%\cgyiesuo.exe'
- '%CommonProgramFiles%\deskop.exe'
- '%CommonProgramFiles%\cgyplay.exe'
- '%PROGRAM_FILES%\vip.exe'
- '%CommonProgramFiles%\AboutUs.exe'
- '%CommonProgramFiles%\FunshionInstall_C8776.exe' (downloaded from the Internet)
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
Modifies file system :
Creates the following files:
- %WINDIR%\kingsoftv\is-5J5TB.tmp
- %WINDIR%\kingsoftv\is-IR4GR.tmp
- %HOMEPATH%\Desktop\ёЯЗеУ°КУІҐ·ЕЖч.lnk
- %WINDIR%\kingsoftv\is-2P734.tmp
- %WINDIR%\kingsoftv\is-RHV68.tmp
- %WINDIR%\kingsoftv\is-EAM94.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\УОП·.url.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Ч¬З®ПоДї.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ЅЎїµmmНш.url
- %TEMP%\is-2V30P.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-2V30P.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-KIECN.tmp\vip.tmp
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\urlcache.dat
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\spitesp.dat
- %CommonProgramFiles%\FunshionInstall_C8776.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\download[1].php
- %TEMP%\is-2V30P.tmp\is-N3H6N.tmp
- %TEMP%\is-2V30P.tmp\is-53KGJ.tmp
- %WINDIR%\kingsoftv\is-QUVBR.tmp
- %WINDIR%\kingsoftv\KWSSVC.log
- %WINDIR%\kingsoftv\unins000.dat
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\is-2K7CG.tmp
- %PROGRAM_FILES%\InccconetTV\Icons\Ч¬З®ПоДї.ico
- %PROGRAM_FILES%\InccconetTV\Icons\°Щ¶И.ico
- %CommonProgramFiles%\cgyguard.exe
- %PROGRAM_FILES%\InccconetTV\Icons\УОП·.ico
- %PROGRAM_FILES%\InccconetTV\Icons\МФ±¦.ico
- %PROGRAM_FILES%\InccconetTV\Icons\Google.ico
- %CommonProgramFiles%\deskop.exe
- %PROGRAM_FILES%\InccconetTV\cgyset.exe
- %CommonProgramFiles%\CigInf.ini
- %CommonProgramFiles%\AboutUs.exe
- %CommonProgramFiles%\cgyiesuo.exe
- %CommonProgramFiles%\cgyplay.exe
- %HOMEPATH%\Favorites\УОП·.url.url
- %HOMEPATH%\Favorites\Ч¬З®ПоДї.url
- %PROGRAM_FILES%\vip.exe
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\МФ±¦.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Google.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\°Щ¶И.url
- %HOMEPATH%\Favorites\°Щ¶И.url
- %PROGRAM_FILES%\InccconetTV\Icons\ЅЎїµ.ico
- %PROGRAM_FILES%\InccconetTV\Icons\IE.ico
- %HOMEPATH%\Favorites\ЅЎїµmmНш.url
- %HOMEPATH%\Favorites\МФ±¦.url
- %HOMEPATH%\Favorites\Google.url
Deletes the following files:
- %PROGRAM_FILES%\InccconetTV\Icons\ЅЎїµ.ico.tmp
- %PROGRAM_FILES%\vip.exe
- %PROGRAM_FILES%\InccconetTV\Icons\ЅЎїµ.ico
- %PROGRAM_FILES%\InccconetTV\Icons\IE.ico
- %PROGRAM_FILES%\InccconetTV\Icons\IE.ico.tmp
- %TEMP%\is-2V30P.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-KIECN.tmp\vip.tmp
- %TEMP%\is-2V30P.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-2V30P.tmp\time.dll
- %TEMP%\is-2V30P.tmp\nsExec.dll
- %PROGRAM_FILES%\InccconetTV\Icons\Ч¬З®ПоДї.ico.tmp
- %PROGRAM_FILES%\InccconetTV\Icons\Google.ico
- %PROGRAM_FILES%\InccconetTV\Icons\Ч¬З®ПоДї.ico
- %PROGRAM_FILES%\InccconetTV\Icons\°Щ¶И.ico
- %PROGRAM_FILES%\InccconetTV\Icons\°Щ¶И.ico.tmp
- %PROGRAM_FILES%\InccconetTV\Icons\УОП·.ico
- %PROGRAM_FILES%\InccconetTV\Icons\УОП·.ico.tmp
- %PROGRAM_FILES%\InccconetTV\Icons\МФ±¦.ico.tmp
- %PROGRAM_FILES%\InccconetTV\Icons\Google.ico.tmp
- %PROGRAM_FILES%\InccconetTV\Icons\МФ±¦.ico
Moves the following files:
- from %TEMP%\is-2V30P.tmp\is-53KGJ.tmp to %TEMP%\is-2V30P.tmp\time.dll
- from %WINDIR%\kingsoftv\is-QUVBR.tmp to %WINDIR%\kingsoftv\kwsui.dll
- from %ALLUSERSPROFILE%\Application Data\kingsoft\kws\is-2K7CG.tmp to %ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
- from %TEMP%\is-2V30P.tmp\is-N3H6N.tmp to %TEMP%\is-2V30P.tmp\nsExec.dll
- from %WINDIR%\kingsoftv\is-2P734.tmp to %WINDIR%\kingsoftv\kwssp.dll
- from %WINDIR%\kingsoftv\is-5J5TB.tmp to %WINDIR%\kingsoftv\KSWBC.dll
- from %WINDIR%\kingsoftv\is-IR4GR.tmp to %WINDIR%\kingsoftv\unins000.exe
- from %WINDIR%\kingsoftv\is-RHV68.tmp to %WINDIR%\kingsoftv\KSWebShield.exe
- from %WINDIR%\kingsoftv\is-EAM94.tmp to %WINDIR%\kingsoftv\kswebshield.dll
Network activity:
Connects to:
- 'ne#####.funshion.com':80
- 'ap#.#c120.com':80
- 'mm###.#estwanwan.info':12345
- 'localhost':1036
- 'localhost':1037
TCP:
HTTP GET requests:
- ap#.#c120.com/false_host/
- ne#####.funshion.com/software/download.php?id#######################################
UDP:
- DNS ASK ap#.#c120.com
- DNS ASK ne#####.funshion.com
- DNS ASK mm###.#estwanwan.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'kws::OSUCWindowClass' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: '???? 2.1.0.20 Beta ????????'
- ClassName: '(null)' WindowName: 'ks_xuyixin'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Progman' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'SHELLDLL_DefView' WindowName: '(null)'
