Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,%APPDATA%\88E66\6DD2D.exe'
Malicious functions:
Modifies settings of Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnZoneCrossing' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:56505'
- [<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPost' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPost' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnZoneCrossing' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1407' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2301' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\LP\2D98\1.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ua[1].php
- %PROGRAM_FILES%\LP\2D98\2.exe
- %APPDATA%\88E66\6DD2D.exe
- %APPDATA%\88E66\680F.8E6
Deletes the following files:
- %PROGRAM_FILES%\LP\2D98\2.exe
- %PROGRAM_FILES%\LP\2D98\1.exe
Network activity:
Connects to:
- 'cl.###abatory.com':80
- 'localhost':56505
- 'cl.##ras-ip.com':443
- 'xp###ats.com':80
- 'cl.##ras-ip.com':80
- 'bi#####tonschools.org':80
- 'localhost':1040
- 'cl.#####ryreanimayion.com':80
TCP:
HTTP GET requests:
- cl.###abatory.com/logo.png?sv########################################################################################
- xp###ats.com/k1.php?tq#############################################################################################################################################################
- xp###ats.com/k1.php?tq###########################################################################################################################################################
- cl.##ras-ip.com/g/ua.php?tq#################################
- bi#####tonschools.org/images/ace/1/ace_1101278014_1314729789.jpg?sv##################################################
- cl.##ras-ip.com/logo.png?tq#################################
- cl.#####ryreanimayion.com/logo.png?sv########################################################################################
UDP:
- DNS ASK xp###ats.com
- DNS ASK cl.#####ryreanimayion.com
- DNS ASK cl.###abatory.com
- DNS ASK bi#####tonschools.org
- DNS ASK cl.##ras-ip.com
- '<Private IP address>':1036
- '<Private IP address>':1035
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''