Trojan.Siggen33.38723

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'CareUEyes' = '%APPDATA%\CareUEyes\CareUEyes.exe /tray'

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im CareUEyes.exe

Patches code

in dll

careueyes.exe process, KERNEL32.dll module

Modifies file system

Creates the following files

%TEMP%\rarsfx0\install.cmd
%TEMP%\rarsfx0\crack\careueyes.exe
%TEMP%\rarsfx0\careueyes_setup.exe
%TEMP%\rarsfx0\crack\setting_v2.dat
%TEMP%\rarsfx0\careueyes.reg
nul
%TEMP%\is-phljc.tmp\careueyes_setup.tmp
%TEMP%\is-rgns5.tmp\_isetup\_setup64.tmp
%APPDATA%\careueyes\is-ala7d.tmp
%APPDATA%\careueyes\is-l5div.tmp
%APPDATA%\careueyes\is-ifccv.tmp
%APPDATA%\careueyes\is-38kgb.tmp
%APPDATA%\careueyes\is-hlb7f.tmp
%APPDATA%\careueyes\wallpaper\is-mbbqa.tmp
%APPDATA%\careueyes\wallpaper\is-vh1kn.tmp
%APPDATA%\careueyes\wallpaper\is-p7l61.tmp
%APPDATA%\careueyes\wallpaper\is-sguuq.tmp
%APPDATA%\careueyes\wallpaper\is-9305v.tmp
%APPDATA%\careueyes\wallpaper\is-42023.tmp
%APPDATA%\careueyes\wallpaper\is-dl87t.tmp
%APPDATA%\careueyes\wallpaper\is-1g535.tmp
%APPDATA%\microsoft\windows\start menu\programs\careueyes\careueyes.lnk
%HOMEPATH%\desktop\careueyes.lnk
%APPDATA%\microsoft\windows\start menu\programs\careueyes\uninstall careueyes.lnk
%APPDATA%\careueyes\unins000.dat
%APPDATA%\careueyes\setting_v2.dat
%APPDATA%\careueyes\careueyes.exe
%TEMP%\msg.vbs
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a822f8e-1338.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a822f91-118c.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a38bbd7fb1b75568_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\72a65b27d2d367b5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\cf76a32c241354c0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8fa93cf99b026ad0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\01738cbadb9d7d2b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6db860e0612d1d0e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3c92d3695ecc1c5b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0ba8f105858419f4_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c5e71308aa204842_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2bd4381cd0d4b9ce_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\007f46c6c20dbe49_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\143b840938b3717d_0
%TEMP%\50e93a54-4380-42bf-a75c-66ac7060a258.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\27308a5870fab063_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\32f0511576ba42ac_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\175adcb7bf3b7a51_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9a60736891a9c343_0
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\55387b9a16ab43b8_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c28ffe1a9d69147f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\50db56f6f2abae3d_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ec9c25db25c92942_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a3f2f7ace941d605_0
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp

Deletes following files that it created itself

%TEMP%\is-rgns5.tmp\_isetup\_setup64.tmp
%TEMP%\is-phljc.tmp\careueyes_setup.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a822f8e-1338.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a822f91-118c.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001

Moves the following files

from %APPDATA%\careueyes\is-ala7d.tmp to %APPDATA%\careueyes\unins000.exe
from %APPDATA%\careueyes\is-l5div.tmp to %APPDATA%\careueyes\careueyes.exe
from %APPDATA%\careueyes\is-ifccv.tmp to %APPDATA%\careueyes\update.exe
from %APPDATA%\careueyes\is-38kgb.tmp to %APPDATA%\careueyes\config.dat
from %APPDATA%\careueyes\is-hlb7f.tmp to %APPDATA%\careueyes\alert_sound.wav
from %APPDATA%\careueyes\wallpaper\is-mbbqa.tmp to %APPDATA%\careueyes\wallpaper\1.jpg
from %APPDATA%\careueyes\wallpaper\is-vh1kn.tmp to %APPDATA%\careueyes\wallpaper\2.jpg
from %APPDATA%\careueyes\wallpaper\is-p7l61.tmp to %APPDATA%\careueyes\wallpaper\3.jpg
from %APPDATA%\careueyes\wallpaper\is-sguuq.tmp to %APPDATA%\careueyes\wallpaper\4.jpg
from %APPDATA%\careueyes\wallpaper\is-9305v.tmp to %APPDATA%\careueyes\wallpaper\5.jpg
from %APPDATA%\careueyes\wallpaper\is-42023.tmp to %APPDATA%\careueyes\wallpaper\6.jpg
from %APPDATA%\careueyes\wallpaper\is-dl87t.tmp to %APPDATA%\careueyes\wallpaper\7.jpg
from %APPDATA%\careueyes\wallpaper\is-1g535.tmp to %APPDATA%\careueyes\wallpaper\8.jpg
from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Network activity

Connects to

'localhost':49691
'localhost':49693
'ca###eyes.com':80
'localhost':49696
'localhost':49698
'ip##pi.com':80
'co####.edge.skype.com':443
'ab##a.co':443
'x1.#.lencr.org':80
'sd##.#hopifycdn.com':443
'aj##.#oogleapis.com':443
'pa#####.#ooglesyndication.com':443
'cse.google.com':443
'sy#####tedsearch.goog':443
'go######s.g.doubleclick.net':443
'ep#.####afficquality.google':443

TCP

HTTP GET requests

http://ca###eyes.com/careueyes/v1/config/switch15.dat
http://ip##pi.com/json
http://x1.#.lencr.org/

Other

'localhost':49691
'localhost':49693
'localhost':49694
'localhost':49696
'localhost':49698
'localhost':49699
'co####.edge.skype.com':443
'ab##a.co':443
'sd##.#hopifycdn.com':443
'aj##.#oogleapis.com':443
'pa#####.#ooglesyndication.com':443
'cse.google.com':443
'google.com':443
'fundingchoicesmessages.google.com':443
'go######s.g.doubleclick.net':443
'ep#.####afficquality.google':443

UDP

DNS ASK ca###eyes.com
DNS ASK ip##pi.com
DNS ASK co####.edge.skype.com
DNS ASK ab##a.co
DNS ASK x1.#.lencr.org
DNS ASK sd##.#hopifycdn.com
DNS ASK aj##.#oogleapis.com
DNS ASK pa#####.#ooglesyndication.com
DNS ASK cse.google.com
DNS ASK google.com
DNS ASK ad######ustomsearchads.com
DNS ASK sy#####tedsearch.goog
DNS ASK go######s.g.doubleclick.net
DNS ASK fundingchoicesmessages.google.com
DNS ASK ep#.####afficquality.google

Miscellaneous

Searches for the following windows

ClassName: 'Edit' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Creates and executes the following

'%TEMP%\rarsfx0\careueyes_setup.exe' /silent
'%TEMP%\is-phljc.tmp\careueyes_setup.tmp' /SL5="$20150,4809121,68608,%TEMP%\RarSFX0\CareUEyes_setup.exe" /silent
'%APPDATA%\careueyes\careueyes.exe' /gamma
'%APPDATA%\careueyes\careueyes.exe' /install /tray
'<SYSTEM32>\wscript.exe' //nologo "%TEMP%\Msg.vbs" " ▪️ mr professor" " Installation, & Activation SuccessFully ▪️" " Silent Install " " ▪️ absba.co/vb ▪️ mr professor ▪️" >nul 2>&1 && del "%TEMP%\Msg.vbs" 2>nul

Executes the following

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\INSTALL.cmd" "
'<SYSTEM32>\fltmc.exe'
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\mode.com' con: cols=65 lines=14
'<SYSTEM32>\robocopy.exe' /E /R:3 /W:2 /IS /IT /IM "%TEMP%\RarSFX0\Crack" "%APPDATA%\CareUEyes"
'<SYSTEM32>\reg.exe' import "%TEMP%\RarSFX0\CareUEyes.reg"
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://absba.co/vb/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://absba.co/vb/
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,14724488000586559238,15515298249257779976,131072 --lang=en-US --service-sandbox-type=none --mojo...
'%APPDATA%\careueyes\careueyes.exe' /gamma' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://absba.co/vb/' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial