Trojan.StartPage1.58314

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\8n8n6ugm] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\8n8n6ugm] 'ImagePath' = '%WINDIR%\Media\8n8n6ugm.mui'

Malicious functions

Terminates or attempts to terminate

the following system processes:

%WINDIR%\explorer.exe

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system

Creates the following files

%APPDATA%\sogouexplorer.zip
<LS_APPDATA>\tencent\qqbrowser\user data\default\file system\000\t\.usage
<LS_APPDATA>\tencent\qqbrowser\user data\default\file system\000\t\paths\current
<LS_APPDATA>\tencent\qqbrowser\user data\default\file system\000\t\paths\log
<LS_APPDATA>\tencent\qqbrowser\user data\default\file system\000\t\paths\manifest-000001
<LS_APPDATA>\tencent\qqbrowser\user data\default\file system\origins\000003.log
<LS_APPDATA>\tencent\qqbrowser\user data\default\file system\origins\current
<LS_APPDATA>\tencent\qqbrowser\user data\default\file system\origins\log
<LS_APPDATA>\tencent\qqbrowser\user data\default\google profile.ico
<LS_APPDATA>\tencent\qqbrowser\user data\default\local extension settings\mlehopoocpjmcnmdglgkbkciccefgmfk\log
<LS_APPDATA>\tencent\qqbrowser\user data\default\history
<LS_APPDATA>\tencent\qqbrowser\user data\default\history provider cache
<LS_APPDATA>\tencent\qqbrowser\user data\default\history2
<LS_APPDATA>\tencent\qqbrowser\user data\default\last session
<LS_APPDATA>\tencent\qqbrowser\user data\default\last tabs
<LS_APPDATA>\tencent\qqbrowser\user data\default\local extension settings\mlehopoocpjmcnmdglgkbkciccefgmfk\000003.log
<LS_APPDATA>\tencent\qqbrowser\user data\default\local extension settings\mlehopoocpjmcnmdglgkbkciccefgmfk\current
<LS_APPDATA>\tencent\qqbrowser\user data\default\features
<LS_APPDATA>\tencent\qqbrowser\user data\default\file system\origins\manifest-000001
<LS_APPDATA>\tencent\qqbrowser\user data\default\favicons
<LS_APPDATA>\tencent\qqbrowser\user data\default\data_reduction_proxy_leveldb\log.old
<LS_APPDATA>\tencent\qqbrowser\user data\default\current
<LS_APPDATA>\tencent\qqbrowser\user data\default\current session
<LS_APPDATA>\tencent\qqbrowser\user data\default\current tabs
<LS_APPDATA>\tencent\qqbrowser\user data\default\data.qbl
<LS_APPDATA>\tencent\qqbrowser\user data\default\databases\databases.db
<LS_APPDATA>\tencent\qqbrowser\user data\default\data_reduction_proxy_leveldb\current
<LS_APPDATA>\tencent\qqbrowser\user data\default\data_reduction_proxy_leveldb\log
<LS_APPDATA>\tencent\qqbrowser\user data\default\data_reduction_proxy_leveldb\manifest-000020
<LS_APPDATA>\tencent\qqbrowser\user data\default\extension state\log.old
<LS_APPDATA>\tencent\qqbrowser\user data\default\extension rules\000003.log
<LS_APPDATA>\tencent\qqbrowser\user data\default\extension rules\current
<LS_APPDATA>\tencent\qqbrowser\user data\default\extension rules\log
<LS_APPDATA>\tencent\qqbrowser\user data\default\extension rules\manifest-000001
<LS_APPDATA>\tencent\qqbrowser\user data\default\extension state\000003.log
<LS_APPDATA>\tencent\qqbrowser\user data\default\extension state\current
<LS_APPDATA>\tencent\qqbrowser\user data\default\extension state\log
<LS_APPDATA>\tencent\qqbrowser\user data\default\extension state\manifest-000001
<LS_APPDATA>\tencent\qqbrowser\user data\default\network persistent state
%TEMP%\oluscmbuy\cleanup.exe
<LS_APPDATA>\tencent\qqbrowser\user data\default\local storage\leveldb\000003.log
<LS_APPDATA>\tencent\qqbrowser\user data\default\session storage\current
<LS_APPDATA>\tencent\qqbrowser\user data\default\session storage\log
<LS_APPDATA>\tencent\qqbrowser\user data\default\session storage\manifest-000001
<LS_APPDATA>\tencent\qqbrowser\user data\default\shortcuts
<LS_APPDATA>\tencent\qqbrowser\user data\default\thumbnails\current
<LS_APPDATA>\tencent\qqbrowser\user data\default\thumbnails\log
<LS_APPDATA>\tencent\qqbrowser\user data\default\thumbnails\log.old
<LS_APPDATA>\tencent\qqbrowser\user data\default\top sites
<LS_APPDATA>\tencent\qqbrowser\user data\default\local extension settings\mlehopoocpjmcnmdglgkbkciccefgmfk\manifest-000001
<LS_APPDATA>\tencent\qqbrowser\user data\default\transportsecurity
<LS_APPDATA>\tencent\qqbrowser\user data\default\visited links
<LS_APPDATA>\tencent\qqbrowser\user data\default\web data
<LS_APPDATA>\tencent\qqexp.reg
%WINDIR%\setup\state\tmpstate.7z
%TEMP%\kehes0wx5\7za.exe
%WINDIR%\setup\state\ssl\certum trusted network ca 2.cer
<LS_APPDATA>\tencent\qqbrowser\user data\default\session storage\000003.log
<LS_APPDATA>\tencent\qqbrowser\user data\default\cookies
<LS_APPDATA>\tencent\qqbrowser\user data\default\secure preferences
<LS_APPDATA>\tencent\qqbrowser\user data\default\network action predictor
<LS_APPDATA>\tencent\qqbrowser\user data\default\local storage\leveldb\current
<LS_APPDATA>\tencent\qqbrowser\user data\default\local storage\leveldb\log
<LS_APPDATA>\tencent\qqbrowser\user data\default\local storage\leveldb\log.old
<LS_APPDATA>\tencent\qqbrowser\user data\default\local storage\leveldb\manifest-000001
<LS_APPDATA>\tencent\qqbrowser\user data\default\log
<LS_APPDATA>\tencent\qqbrowser\user data\default\log.old
<LS_APPDATA>\tencent\qqbrowser\user data\default\manifest-000006
<LS_APPDATA>\tencent\qqbrowser\user data\default\local extension settings\mlehopoocpjmcnmdglgkbkciccefgmfk\log.old
<LS_APPDATA>\tencent\qqbrowser\user data\default\repeal_data.json
<LS_APPDATA>\tencent\qqbrowser\user data\default\page_load_capping_opt_out.db
<LS_APPDATA>\tencent\qqbrowser\user data\default\preferences
<LS_APPDATA>\tencent\qqbrowser\user data\default\preferences.bak
<LS_APPDATA>\tencent\qqbrowser\user data\default\preferences_01
<LS_APPDATA>\tencent\qqbrowser\user data\default\previews_opt_out.db
<LS_APPDATA>\tencent\qqbrowser\user data\default\quick links
<LS_APPDATA>\tencent\qqbrowser\user data\default\quotamanager
<LS_APPDATA>\tencent\qqbrowser\user data\default\searchfav
<LS_APPDATA>\tencent\qqbrowser\user data\default\thumbnails\manifest-000001
<LS_APPDATA>\tencent\qqbrowser\user data\default\config bookmarks.zip
%APPDATA%\360se6\user data\default\bookmarks
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\cookies.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\crashes\store.json.mozlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176053914.5498e1db-ec83-4398-aabb-b1d74c46f34f.event.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176054084.f5a3d023-6b36-427f-bc5c-bd49e0c96f27.new-profile.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176054155.2c95b9b6-7cc4-4276-9e1b-ac1f479f8290.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176054159.0b2c25df-0121-4515-a72e-939763fa69f3.first-shutdown.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176074239.244ad4e5-4553-4c93-8a73-f0b58f447521.health.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176074306.3d6e140b-0686-4f27-9f81-c4f16cf75495.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552200848746.e426a42e-682c-4b51-9c8d-39245af55444.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057491907.974d8be3-0c22-430b-8358-1037dcc4fc17.health.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057491958.016da8e6-a809-4924-a57d-7f1d626b4b0a.health.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057492363.a896da6c-7cc7-4347-b363-ecbcd243186b.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057859077.ee4531e2-b7ad-40c1-90ba-2fa0ca72ff2a.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057910953.ee1065d6-4494-45af-bc11-52c515b5fc5f.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552200569992.47f1c95a-8f91-43fb-896e-6a290faab258.main.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552200813338.f6202e8d-499e-4a5a-928a-67794e6d5eb0.modules.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\content-prefs.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176074280.5d271550-2d96-4bfa-8bb8-20a394e876cc.health.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\containers.json
%APPDATA%\baidu\baidubrowser\user_data\default\settings\settings.db
%APPDATA%\sogouexplorer\favorite3.dat
<LS_APPDATA>\google.zip
<LS_APPDATA>\google\chrome\user data\default\bookmarks
<LS_APPDATA>\360chrome\chrome\user data\default\bookmarks
<LS_APPDATA>\2345explorer\user data\default\bookmarksv2
%APPDATA%\baidu\baidubrowser.zip
%APPDATA%\baidu\baidubrowser\user_data\default\bookmark\bookmark.db
%APPDATA%\baidu\baidubrowser\user_data\default\settings\user_setting.db
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\cert9.db
%APPDATA%\mozilla.zip
%APPDATA%\mozilla\firefox\crash reports\installtime20190211233335
%APPDATA%\mozilla\firefox\crash reports\installtime20190225143501
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\addons.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\addonstartup.json.lz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\blocklist.xml
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\broadcast-listeners.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\compatibility.ini
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessioncheckpoints.json
<LS_APPDATA>\tencent\qqbrowser\user data\default\budgetdatabase\log.old
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\extensions.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\times.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\weave\failed\tabs.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\weave\tofetch\tabs.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\webappsstore.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\xulstore.json
%APPDATA%\mozilla\firefox\profiles\profiles.log
<LS_APPDATA>\tencent\qqbrowser.zip
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\state.json
<LS_APPDATA>\tencent\qqbrowser\user data\default\.beacon_analytics.db
<LS_APPDATA>\tencent\qqbrowser\user data\default\bookmarks
<LS_APPDATA>\tencent\qqbrowser\user data\default\bookmarks.bak
<LS_APPDATA>\tencent\qqbrowser\user data\default\bookmarks_01
<LS_APPDATA>\tencent\qqbrowser\user data\default\bookmarks_01.bak
<LS_APPDATA>\tencent\qqbrowser\user data\default\budgetdatabase\current
<LS_APPDATA>\tencent\qqbrowser\user data\default\budgetdatabase\log
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite
<LS_APPDATA>\tencent\qqbrowser\user data\default\budgetdatabase\manifest-000001
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\search.json.mozlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\handlers.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\key4.db
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\permissions.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\pkcs11.txt
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\places.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\pluginreg.dat
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\prefs.js
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\session-state.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\.metadata
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore-backups\previous.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore-backups\upgrade.jsonlz4-20190211233335
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore-backups\upgrade.jsonlz4-20190225143501
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore.jsonlz4
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\shield-preference-experiments.json
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sitesecurityservicestate.txt
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage.sqlite
%APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\.metadata-v2
%WINDIR%\media\8n8n6ugm.mui

Deletes the following files

%APPDATA%\sogouexplorer.zip
<LS_APPDATA>\google.zip
%APPDATA%\baidu\baidubrowser.zip
%APPDATA%\mozilla.zip
<LS_APPDATA>\tencent\qqbrowser.zip
<LS_APPDATA>\tencent\qqexp.reg
%WINDIR%\setup\state\state.ini
%TEMP%\kehes0wx5\7za.exe
%WINDIR%\setup\state\tmpstate.7z
%TEMP%\oluscmbuy\cleanup.exe

Substitutes the following files

<LS_APPDATA>\Google\Chrome\User Data\Default\Preferences
<LS_APPDATA>\Google\Chrome\User Data\Default\Secure Preferences
%APPDATA%\Mozilla\Firefox\profiles.ini

Network activity

Connects to

'11#.#14.114.114':53

UDP

DNS ASK ba##u.com

Miscellaneous

Adds a root certificate

Searches for the following windows

ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'ГЏВµГЌВіГ‰ГЁГ–ГѓВёГјВёГ„'
ClassName: '' WindowName: 'Windows Г—ГЉГ”ВґВ№ГњГЂГГ†Г·'
ClassName: '' WindowName: 'ГЌГёГ–В·ВґГіГ€В« - Г‹Г‘В№В·ВёГџГ‹Г™Г¤ВЇГЂГЂГ†Г·'
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: 'Proxy Desktop' WindowName: ''

Creates and executes the following

'%TEMP%\kehes0wx5\7za.exe' x "%WINDIR%\Setup\State\TmpState.7z" -o"%WINDIR%\Setup\State" -aoa -t7z -pU#wnfh7us81.7ev&nv
'%TEMP%\oluscmbuy\cleanup.exe'
'%WINDIR%\syswow64\cmd.exe' /c regedit /s "<LS_APPDATA>\Tencent\qqexp.reg"' (with hidden window)
'%TEMP%\kehes0wx5\7za.exe' x "%WINDIR%\Setup\State\TmpState.7z" -o"%WINDIR%\Setup\State" -aoa -t7z -pU#wnfh7us81.7ev&nv' (with hidden window)
'%TEMP%\oluscmbuy\cleanup.exe' ' (with hidden window)
'%WINDIR%\syswow64\explorer.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c regedit /s "<LS_APPDATA>\Tencent\qqexp.reg"
'%WINDIR%\syswow64\regedit.exe' /s "<LS_APPDATA>\Tencent\qqexp.reg"
'%WINDIR%\syswow64\explorer.exe'

Attempts to shut down the Windows operating system.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial