Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftResultSystem' = '"%APPDATA%\Roaming\MicrosoftResult\Microsoft_zuhosoliha.exe"'
Malicious functions:
Executes the following:
- '<SYSTEM32>\ctfmon.exe'
- '%PROGRAM_FILES%\Internet Explorer\iexplore.exe' -noframemerging http://sc##pi0n
- '<SYSTEM32>\svchost.exe'
Modifies file system :
Creates the following files:
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\errorPageStrings[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\NewErrorPageTemplate[1]
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\httpErrorPagesScripts[1]
- <LS_APPDATA>\Microsoft\Internet Explorer\imagestore\g1bfg6d\imagestore.dat
- %APPDATA%\Roaming\Microsoft\Protect\S-1-5-21-2832440558-3064306045-1455513625-1000\267eccfd-f5b5-4c39-b107-a8652acd37fd
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\dnserror[1]
- <LS_APPDATA>\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E6CD0A44-055F-11E5-973E-AE7B574E54F2}.dat
- %APPDATA%\Roaming\MicrosoftResult\Microsoft_zuhosoliha.exe
- %TEMP%\~DFA15A89DE51030CAE.TMP
- %TEMP%\~DF604FDA336C176261.TMP
- <LS_APPDATA>\Microsoft\Internet Explorer\Recovery\High\Active\{E6CD0A46-055F-11E5-973E-AE7B574E54F2}.dat
Deletes itself.
Network activity:
Connects to:
- 'localhost':5357
UDP:
- DNS ASK dn#.##ftncsi.com
- DNS ASK go.###rosoft.com
- DNS ASK ie#####t.microsoft.com
- DNS ASK fi###r8888-2.eu
- 'localhost':62714
- 'localhost':54568
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Internet Explorer 10'
- ClassName: '' WindowName: 'Internet Explorer 9'
- ClassName: '' WindowName: 'Internet Explorer 8'
- ClassName: '' WindowName: 'Set Up Windows Internet Explorer'
- ClassName: '' WindowName: 'Set Up Windows Internet Explorer 10'
- ClassName: '' WindowName: 'Set Up Windows Internet Explorer 9'
- ClassName: '' WindowName: 'Set Up Windows Internet Explorer 8'
- ClassName: '' WindowName: 'Internet Explorer Security'
- ClassName: '' WindowName: 'Warning - Security'
- ClassName: '' WindowName: 'Security Information'
- ClassName: '' WindowName: 'Internet Explorer - Security Warning'
- ClassName: '' WindowName: 'Internet Explorer 11'
- ClassName: '' WindowName: 'Windows Security Alert'
- ClassName: '' WindowName: 'Windows Security Warning'
- ClassName: '' WindowName: 'Microsoft Phishing Filter'
- ClassName: '' WindowName: 'Phishing Filter'
- ClassName: '' WindowName: 'Information Bar'
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Message from webpage'
- ClassName: '' WindowName: 'About Internet Explorer'
- ClassName: '' WindowName: 'Set Up Windows Internet Explorer 11'
- ClassName: '' WindowName: 'Internet Explorer Alert!'
- ClassName: '' WindowName: 'JavaScript Alert'
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Internet Explorer Alert'
- ClassName: '' WindowName: 'Windows Security'
- ClassName: '' WindowName: 'Warning!'
- ClassName: '' WindowName: 'Warning'
- ClassName: '' WindowName: 'Internet Connection Error'
- ClassName: '' WindowName: 'Reflect'
- ClassName: '' WindowName: 'Internet Explorer Script Error'
- ClassName: '' WindowName: 'Windows Network Diagnostics'
- ClassName: '' WindowName: 'Work Offline'
- ClassName: '' WindowName: 'Internet Explorer - Search Provider Default'
- ClassName: '' WindowName: 'Add Search Provider'
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'Add Search Engine'
- ClassName: '' WindowName: 'Connection Error'
- ClassName: '' WindowName: 'Set up Internet Explorer'
- ClassName: '' WindowName: 'Privacy Alert'
- ClassName: '' WindowName: 'Windows Internet Explorer 11'
- ClassName: '' WindowName: 'Windows Internet Explorer 10'
- ClassName: '' WindowName: 'Windows Internet Explorer 9'
- ClassName: '' WindowName: 'Internet Explorer'
- ClassName: '' WindowName: 'Security Warning'
- ClassName: '' WindowName: 'Security Alert'
- ClassName: '' WindowName: 'Security'
- ClassName: '' WindowName: 'Webpage Error'
- ClassName: '' WindowName: 'Debugging Requires Webpage Refresh'
- ClassName: '' WindowName: 'Script Error'
- ClassName: '' WindowName: 'Error'
- ClassName: '' WindowName: 'Windows Internet Explorer 8'
- ClassName: '' WindowName: 'Windows Internet Explorer'
- ClassName: '' WindowName: 'Web Browser'
