Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\abc2.0] 'ImagePath' = '%TEMP%\~abcKzREd.sys'
Creates the following services
- 'abc2.0' %TEMP%\~abcKzREd.sys
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\~abcKzREd.sys
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68fde1d7-9b4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68fde1d7-bb8.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68fe6b6b-b98.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c2d617fff942f655_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\73ea4d2744f211bb_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a83ad75ac1d7a8f0_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\dd6a93fd38ae1b30_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3d74fae548893758_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\622196ee501069ea_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3a7679f3768aaaf0_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\70b4429e650ca932_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\35700dbc514dfcdd_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e35037062568db37_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ace2b5930600847c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\34d2f6bfd2c58901_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5d14ba327bfc1dd0_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\310d7a4d3d4a3615_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3d9750b9152a9ee5_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ac71c6b19c4c6ac4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f0db99e818927814_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fd1b7e3722641ce1_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7131b10fef60ff6e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\61fdb0f9e35e82f8_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ed28c0e462b2ffb7_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a5a7750eddf76ce9_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3bd6cbb77ed4fa78_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6af6929c5f7b3748_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\07f4ed7ecf90bcc4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\77c5f045e89344ad_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2477697eaf31ca31_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4b624c31eb1a85eb_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b67da23557465ba5_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9c960f3bca3a41d8_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1c04b16980353527_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d93072f71999060d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ed9eeef5024b6c0a_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9db60a2b0f743c57_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b62744bf9faf3618_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d162e8c9ea04b9dc_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\598341c10b88a1e0_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\95774cba8e0d6b6e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5246971dd6fd5519_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\26f2d5fd2391826e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3bb94542c5dc3027_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
- %TEMP%\7995eb94-a14b-4bac-baaa-0ea7fffe60d2.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1e0b210e4825d6ef_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d306469f0edcee62_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0af3f272417587a9_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\de08f3159e295478_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\80809637c99b7a62_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\04b2acc69a4a837b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000013
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000014
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000015
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5dd0944c07b62362_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000016
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c9e81ad791b57a18_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
Sets the 'hidden' attribute to the following files
- %TEMP%\~abcKzREd.sys
Deletes following files that it created itself
- %TEMP%\~abcKzREd.sys
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68fde1d7-9b4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68fde1d7-bb8.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68fe6b6b-b98.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
Modifies the following files
- %HOMEPATH%\desktop\google chrome.lnk
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons
- %TEMP%\.ses
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Network activity
Connects to
- 'do#####d.kulove123.com':80
- 'co####.edge.skype.com':443
- 'sp#.#aidu.com':443
- 'ps#.##static.com':443
- 'gi###.baidu.com':443
- 'ca####s.digicert.cn':80
- 'ps#####c.cdn.bcebos.com':443
- 'mb#.#aidu.com':443
- 'he####.baidu.com':443
- 'ch##.baidu.com':443
- 'hp#.#aidu.com':443
- 'b.###tatic.com':443
- 'ug.##idu.com':443
TCP
HTTP GET requests
- http://do#####d.kulove123.com/QQgg.txt
- http://ca####s.digicert.cn/DigiCertGlobalRootCA.crt
Other
- 'co####.edge.skype.com':443
- 'sp#.#aidu.com':443
- 'ps#.##static.com':443
- 'gi###.baidu.com':443
- 'he#####tatic.baidu.com':443
- 'mb#.#aidu.com':443
- 'he####.baidu.com':443
- 'ch##.baidu.com':443
- 'hp#.#aidu.com':443
- 'b.###tatic.com':443
- 'ug.##idu.com':443
UDP
- DNS ASK do#####d.kulove123.com
- DNS ASK co####.edge.skype.com
- DNS ASK ba##u.com
- DNS ASK ps#.##static.com
- DNS ASK gi###.baidu.com
- DNS ASK he#####tatic.baidu.com
- DNS ASK ca####s.digicert.cn
- DNS ASK ps#####c.cdn.bcebos.com
- DNS ASK sp#.#aidu.com
- DNS ASK mb#.#aidu.com
- DNS ASK he####.baidu.com
- DNS ASK ch##.baidu.com
- DNS ASK hp#.#aidu.com
- DNS ASK b.###tatic.com
- DNS ASK ug.##idu.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.baidu.com/s?wd=www.dnffz.me
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.baidu.com/s?wd=www.dnffz.me
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1788,775391924700177321,449911059724855317,131072 --lang=en-US --service-sandbox-type=none --mojo-pla...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.baidu.com/s?wd=www.dnffz.me' (with hidden window)
