Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command] '' = '%PROGRAM_FILES%\Internet Explorer\iexplore.exe http://www.jlshoping.com/'
Malicious functions:
Creates and executes the following:
- '%TEMP%\95F62053C0350165FAAE2EF870C20DACA1C9A843507B913C.exe' 95F62053C0350165FAAE2EF870C20DACA1C9A843507B913C 220108WB0024 ІвКФНш°Й CRNJEUFU 2.000.0730 723119
- '%TEMP%\FTMjIzMzA0.exe' -i 192.168.0.240 get FFRMjIzMzA0.dat "%TEMP%\\FFRMjIzMzA0.dat"
- '%PROGRAM_FILES%\5678soft\nbclient\JKNBMS.exe'
- '%TEMP%\95F62053C0350165FAAE2EF870C20DACA1C9A843507B913C.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\net1.exe' stop WinMgmt /y
- '<SYSTEM32>\net.exe' stop WinMgmt /y
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\±ѕµШUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B3B2F0CA-396A-459B-A085-ED5AB5BFD1C1}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\5678soft\nbclient\jknbms.mdns
- %PROGRAM_FILES%\5678soft\nbclient\ErrorLog.txt
- %PROGRAM_FILES%\5678soft\nbclient\UNWISE.EXE
- %PROGRAM_FILES%\5678soft\nbclient\serhis.INI
- %TEMP%\FTMjIzMzA0.exe
- %TEMP%\95F62053C0350165FAAE2EF870C20DACA1C9A843507B913C
- %PROGRAM_FILES%\5678soft\nbclient\ErrorLog_thd.txt
- %TEMP%\FRMjIzMzA0.exe
- %PROGRAM_FILES%\5678soft\nbclient\SoapWebService.dll
- %PROGRAM_FILES%\5678soft\nbclient\JKNBMS.exe
- %PROGRAM_FILES%\5678soft\nbclient\JKServerPS.dll
- %PROGRAM_FILES%\5678soft\nbclient\IEHELPER.dll
- %PROGRAM_FILES%\5678soft\nbclient\INSTALL.LOG
- %PROGRAM_FILES%\5678soft\nbclient\nbmscc.ser
- %PROGRAM_FILES%\5678soft\nbclient\SetParam.exe
- %PROGRAM_FILES%\5678soft\nbclient\JLEncrypt.dll
- %PROGRAM_FILES%\5678soft\nbclient\MYTIMER.sys
Network activity:
Connects to:
- '<Private IP address>':80
- 'www.ii###enter.cn':80
- '<Private IP address>':2000
TCP:
HTTP GET requests:
- <Private IP address>/?pa##################
- www.ii###enter.cn/ini/220108WB0024.txt?pa##################
UDP:
- DNS ASK www.ii###enter.cn
- 'localhost':69
- '<Private IP address>':69
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
