Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Creates and executes the following:
- %PROGRAM_FILES%\Internet Explorer\nav.exe
- %PROGRAM_FILES%\Intarnet Explorer\navi.exe
- %PROGRAM_FILES%\Internet Explorer\iedv.EXE
- %PROGRAM_FILES%\Internet Explorer\zh2.exe
Executes the following:
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Intarnet Explorer.lnk" /G everyone:R
- <SYSTEM32>\wbem\wmic.exe process where "name='smss.exe' and ExecutablePath<>'C:\\WINDOWS\\system32\\smss.exe'" call Terminate
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internet Explorer.lnk" /G everyone:R
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Internat Explorer.lnk" /G everyone:R
- <SYSTEM32>\wbem\wmic.exe process where "name='winlogon.exe' and ExecutablePath<>'C:\\WINDOWS\\system32\\winlogon.exe'" call Terminate
- <SYSTEM32>\reg.exe ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BROWSER HELPER OBJECTS" /f
- <SYSTEM32>\reg.exe ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks" /f
- <SYSTEM32>\reg.exe DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BROWSER HELPER OBJECTS" /f
- <SYSTEM32>\reg.exe DELETE "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks" /f
- <SYSTEM32>\wscript.exe "%PROGRAM_FILES%\Internet Explorer\file.vbs"
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop" /T /G everyone:F
- <SYSTEM32>\cmd.exe /c ""%TEMP%\FE4.CMD" "
- <SYSTEM32>\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Desktop"
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch" /T /G everyone:F
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\Internet Explorer.lnk"
- <SYSTEM32>\attrib.exe +h +r "%HOMEPATH%\Desktop\Internat Explorer.lnk"
- <SYSTEM32>\wscript.exe "%PROGRAM_FILES%\Internet Explorer\tmp.vbs"
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch" /T /G everyone:R
Modifies file system :
Creates the following files:
- %HOMEPATH%\Desktop\РВУаФЪПЯ.url
- %HOMEPATH%\Desktop\НшЦ№ґуИ«.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Exqlorer.lnk
- %PROGRAM_FILES%\Internet Explorer\tmp.vbs
- %HOMEPATH%\Desktop\Intarnet Exqlorer.lnk
- %TEMP%\tmp1.tmp
- <SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
- %PROGRAM_FILES%\Internet Explorer\TempWmicBatchFile.bat
- %TEMP%\tmp3.tmp
- %TEMP%\tmp2.tmp
- <SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
- %PROGRAM_FILES%\Internet Explorer\nav.exe
- %PROGRAM_FILES%\Internet Explorer\zh2.exe
- %PROGRAM_FILES%\Internet Explorer\config.ini
- %PROGRAM_FILES%\Internet Explorer\IEXPL0RE.exe
- %PROGRAM_FILES%\Internet Explorer\iedv.EXE
- %PROGRAM_FILES%\Internet Explorer\ieconfig.ini
- %PROGRAM_FILES%\Internet Explorer\file.vbs
- %TEMP%\process_name.dat
- %PROGRAM_FILES%\Intarnet Explorer\navi.exe
- %TEMP%\FE4.CMD
- %PROGRAM_FILES%\Intarnet Explorer\config.ini
Sets the 'hidden' attribute to the following files:
- %PROGRAM_FILES%\Internet Explorer\ieconfig.ini
- %PROGRAM_FILES%\Internet Explorer\config.ini
- %PROGRAM_FILES%\Internet Explorer\iedv.EXE
Deletes the following files:
- %TEMP%\tmp3.tmp
- %PROGRAM_FILES%\Internet Explorer\TempWmicBatchFile.bat
- %TEMP%\FE4.CMD
- %TEMP%\tmp2.tmp
- %PROGRAM_FILES%\Internet Explorer\file.vbs
- %PROGRAM_FILES%\Internet Explorer\tmp.vbs
- %TEMP%\tmp1.tmp
Network activity:
Connects to:
- '11#.#8.65.29':8383
- 'localhost':1044
- 'ge#.#k2012.info':8383
- 'ge#.##owan365.com':8383
- 'ge#.#cdogs.info':8383
- 'up#.#hegfw.net':8901
- 'up#.#hegfw.net':8900
- 'up#.#hegfw.net':8902
- 'ga##.#9841983.com':8383
- 'www.ba##u.com':80
UDP:
- DNS ASK ge#.#k2012.info
- DNS ASK ge#.#cdogs.info
- DNS ASK ge#.##owan365.com
- DNS ASK ga##.#9841983.com
- DNS ASK up#.#hegfw.net
- DNS ASK www.ba##u.com
- '25#.#55.255.255':8484
- '22#.0.0.1':37777
Miscellaneous:
Searches for the following windows:
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
