Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\HTTP\shell\open\command] '' = '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE http://www.babaw.com/'
Malicious functions:
Creates and executes the following:
- '%TEMP%\is-CL6AU.tmp\is-P5BD3.tmp' /SL4 $200FA "%TEMP%\RarSFX0\MyHome.exe" 52253 52224 /VERYSILENT /SP- /NORESTART
- '%TEMP%\RarSFX0\MyHome.exe' /VERYSILENT /SP- /NORESTART
Executes the following:
- '%WINDIR%\regedit.exe' /S "%HOMEPATH%\Local Settings\Temp.\DefOpen.reg"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\MyHome.cmd" /VERYSILENT /SP- /NORESTART"
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\ИҐДДСЅѕЖµк.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\ИҐХТДгФ¤¶©.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\НГНГНшµј№є.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\ёз№Ф.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\АЦ°ЙНш№єОп.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\DOWNIPA.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\ПВФШУОП·.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\№у±ц№єОпјЫ.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\РгРгНшЕ®РФ.url
- %ALLUSERSPROFILE%\Desktop\°Н°ННшЦ·Ц®јТ.url
- %ALLUSERSPROFILE%\Desktop\АЦ°ЙНш№єОп.url
- %ProgramFiles%\MyHome\unins000.dat
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\лл֧іЦ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\BTµзУ°Нш.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\Зэ¶Ї°Ў.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\ИЄЦЭ113.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\ЕМїн.url
- %ProgramFiles%\MyHome\is-07H2V.tmp
- %ProgramFiles%\MyHome\is-ODFSI.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\°Н°Н№¤ѕЯПд.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\°Н°ННшЦ·Ц®јТ.url
- %TEMP%\is-DMRJA.tmp\_isetup\_shfoldr.dll
- %TEMP%\RarSFX0\MyHome.exe
- %TEMP%\RarSFX0\MyHome.cmd
- %TEMP%\is-DMRJA.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-CL6AU.tmp\is-P5BD3.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\DOWNPK.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\41153.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\ПВФШЦЄµА.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\PKРЎУОП·.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\41113.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\№ИЖХПВФШХѕ.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\°Н°ННЕ№є.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\№ИЖХНш.url
- %ALLUSERSPROFILE%\Start Menu\Programs\ОТµДЙПНшЦчТі\№ИЖХдЇААЖч.url
Deletes the following files:
- %TEMP%\is-CL6AU.tmp\is-P5BD3.tmp
- %TEMP%\RarSFX0\MyHome.cmd
- %TEMP%\RarSFX0\MyHome.exe
- %TEMP%\DefOpen.reg
- %TEMP%\is-DMRJA.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-DMRJA.tmp\_isetup\_shfoldr.dll
Moves the following files:
- from %ProgramFiles%\MyHome\is-07H2V.tmp to %ProgramFiles%\MyHome\MyHome.txt
- from %ProgramFiles%\MyHome\is-ODFSI.tmp to %ProgramFiles%\MyHome\unins000.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'EDIT' WindowName: ''