Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'yqOJeIajcIhTx' = '%ALLUSERSPROFILE%\yqOJeIajcIhTx.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Terminates or attempts to terminate
the following user processes:
- firefox.exe
- iexplore.exe
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp...
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\yqojeiajcihtx.exe
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\doomed\21145
- %LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cache2\entries\609e31b44cf87dbb4ff8cbdbe379d1d485b23b4a
- %TEMP%\tmp1100.tmp
Moves the following files
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\default programs.lnk to %TEMP%\smtmp\1\default programs.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 upload center.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 upload center.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 language preferences.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 language preferences.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft clip organizer.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft office 2010 tools\microsoft clip organizer.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\digital certificate for vba projects.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft office 2010 tools\digital certificate for vba projects.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft infopath filler 2010.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft infopath filler 2010.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft infopath designer 2010.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft infopath designer 2010.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft excel 2010.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft excel 2010.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft access 2010.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft access 2010.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\media center.lnk to %TEMP%\smtmp\1\programs\media center.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\remote assistance.lnk to %TEMP%\smtmp\1\programs\maintenance\remote assistance.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office picture manager.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft office 2010 tools\microsoft office picture manager.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\desktop.ini to %TEMP%\smtmp\1\programs\maintenance\desktop.ini
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\backup and restore center.lnk to %TEMP%\smtmp\1\programs\maintenance\backup and restore center.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\visit java.com.lnk to %TEMP%\smtmp\1\programs\java\visit java.com.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\get help.lnk to %TEMP%\smtmp\1\programs\java\get help.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\configure java.lnk to %TEMP%\smtmp\1\programs\java\configure java.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\check for updates.lnk to %TEMP%\smtmp\1\programs\java\check for updates.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\about java.lnk to %TEMP%\smtmp\1\programs\java\about java.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\gameexplorer.lnk to %TEMP%\smtmp\1\programs\games\gameexplorer.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\desktop.ini to %TEMP%\smtmp\1\programs\games\desktop.ini
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\firefox.lnk to %TEMP%\smtmp\1\programs\firefox.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\desktop.ini to %TEMP%\smtmp\1\programs\desktop.ini
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\create recovery disc.lnk to %TEMP%\smtmp\1\programs\maintenance\create recovery disc.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows fax and scan.lnk to %TEMP%\smtmp\1\programs\windows fax and scan.lnk
- from C:\users\public\desktop\opera.lnk to %TEMP%\smtmp\4\opera.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft publisher 2010.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft publisher 2010.lnk
- from C:\users\public\desktop\mozilla thunderbird.lnk to %TEMP%\smtmp\4\mozilla thunderbird.lnk
- from C:\users\public\desktop\firefox.lnk to %TEMP%\smtmp\4\firefox.lnk
- from C:\users\public\desktop\desktop.ini to %TEMP%\smtmp\4\desktop.ini
- from C:\users\public\desktop\acrobat reader dc.lnk to %TEMP%\smtmp\4\acrobat reader dc.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\windows update.lnk to %TEMP%\smtmp\1\windows update.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\xps viewer.lnk to %TEMP%\smtmp\1\programs\xps viewer.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar.lnk to %TEMP%\smtmp\1\programs\winrar\winrar.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\winrar help.lnk to %TEMP%\smtmp\1\programs\winrar\winrar help.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk to %TEMP%\smtmp\1\programs\winrar\what is new in the latest version.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk to %TEMP%\smtmp\1\programs\winrar\console rar manual.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\windows powershell modules.lnk to %TEMP%\smtmp\1\programs\administrative tools\windows powershell modules.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows media player.lnk to %TEMP%\smtmp\1\programs\windows media player.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows dvd maker.lnk to %TEMP%\smtmp\1\programs\windows dvd maker.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\steam.lnk to %TEMP%\smtmp\1\programs\steam\steam.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\steam support center.url to %TEMP%\smtmp\1\programs\steam\steam support center.url
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\desktop.ini to %TEMP%\smtmp\1\programs\startup\desktop.ini
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sidebar.lnk to %TEMP%\smtmp\1\programs\sidebar.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\microsoft sharepoint workspace 2010.lnk to %TEMP%\smtmp\1\programs\sharepoint\microsoft sharepoint workspace 2010.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\opera.lnk to %TEMP%\smtmp\1\programs\opera.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mozilla thunderbird.lnk to %TEMP%\smtmp\1\programs\mozilla thunderbird.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft word 2010.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft word 2010.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft sharepoint workspace 2010.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft sharepoint workspace 2010.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft onenote 2010.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft onenote 2010.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft powerpoint 2010.lnk to %TEMP%\smtmp\1\programs\microsoft office\microsoft powerpoint 2010.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\windows firewall with advanced security.lnk to %TEMP%\smtmp\1\programs\administrative tools\windows firewall with advanced security.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer.lnk to %TEMP%\smtmp\1\programs\accessories\system tools\windows easy transfer.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\system restore.lnk to %TEMP%\smtmp\1\programs\accessories\system tools\system restore.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\system information.lnk to %TEMP%\smtmp\1\programs\accessories\system tools\system information.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\resource monitor.lnk to %TEMP%\smtmp\1\programs\accessories\system tools\resource monitor.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\disk cleanup.lnk to %TEMP%\smtmp\1\programs\accessories\system tools\disk cleanup.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\dfrgui.lnk to %TEMP%\smtmp\1\programs\accessories\system tools\dfrgui.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini to %TEMP%\smtmp\1\programs\accessories\system tools\desktop.ini
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\character map.lnk to %TEMP%\smtmp\1\programs\accessories\system tools\character map.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sync center.lnk to %TEMP%\smtmp\1\programs\accessories\sync center.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sticky notes.lnk to %TEMP%\smtmp\1\programs\accessories\sticky notes.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\sound recorder.lnk to %TEMP%\smtmp\1\programs\accessories\sound recorder.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\task scheduler.lnk to %TEMP%\smtmp\1\programs\accessories\system tools\task scheduler.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\snipping tool.lnk to %TEMP%\smtmp\1\programs\accessories\snipping tool.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\paint.lnk to %TEMP%\smtmp\1\programs\accessories\paint.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\networkprojection.lnk to %TEMP%\smtmp\1\programs\accessories\networkprojection.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\mobility center.lnk to %TEMP%\smtmp\1\programs\accessories\mobility center.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\math input panel.lnk to %TEMP%\smtmp\1\programs\accessories\math input panel.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\displayswitch.lnk to %TEMP%\smtmp\1\programs\accessories\displayswitch.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\desktop.ini to %TEMP%\smtmp\1\programs\accessories\desktop.ini
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\calculator.lnk to %TEMP%\smtmp\1\programs\accessories\calculator.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\speech recognition.lnk to %TEMP%\smtmp\1\programs\accessories\accessibility\speech recognition.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini to %TEMP%\smtmp\1\programs\accessories\accessibility\desktop.ini
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\desktop.ini to %TEMP%\smtmp\1\desktop.ini
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\remote desktop connection.lnk to %TEMP%\smtmp\1\programs\accessories\remote desktop connection.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\acrobat reader dc.lnk to %TEMP%\smtmp\1\programs\acrobat reader dc.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\system configuration.lnk to %TEMP%\smtmp\1\programs\administrative tools\system configuration.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\desktop.ini to %TEMP%\smtmp\1\programs\accessories\tablet pc\desktop.ini
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\services.lnk to %TEMP%\smtmp\1\programs\administrative tools\services.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\security configuration management.lnk to %TEMP%\smtmp\1\programs\administrative tools\security configuration management.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\print management.lnk to %TEMP%\smtmp\1\programs\administrative tools\print management.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\performance monitor.lnk to %TEMP%\smtmp\1\programs\administrative tools\performance monitor.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\memory diagnostics tool.lnk to %TEMP%\smtmp\1\programs\administrative tools\memory diagnostics tool.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\iscsi initiator.lnk to %TEMP%\smtmp\1\programs\administrative tools\iscsi initiator.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\event viewer.lnk to %TEMP%\smtmp\1\programs\administrative tools\event viewer.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\desktop.ini to %TEMP%\smtmp\1\programs\administrative tools\desktop.ini
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\data sources (odbc).lnk to %TEMP%\smtmp\1\programs\administrative tools\data sources (odbc).lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\computer management.lnk to %TEMP%\smtmp\1\programs\administrative tools\computer management.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\task scheduler.lnk to %TEMP%\smtmp\1\programs\administrative tools\task scheduler.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\component services.lnk to %TEMP%\smtmp\1\programs\administrative tools\component services.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\wordpad.lnk to %TEMP%\smtmp\1\programs\accessories\wordpad.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell.lnk to %TEMP%\smtmp\1\programs\accessories\windows powershell\windows powershell.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise.lnk to %TEMP%\smtmp\1\programs\accessories\windows powershell\windows powershell ise.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise (x86).lnk to %TEMP%\smtmp\1\programs\accessories\windows powershell\windows powershell ise (x86).lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell (x86).lnk to %TEMP%\smtmp\1\programs\accessories\windows powershell\windows powershell (x86).lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\desktop.ini to %TEMP%\smtmp\1\programs\accessories\windows powershell\desktop.ini
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\welcome center.lnk to %TEMP%\smtmp\1\programs\accessories\welcome center.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\windows journal.lnk to %TEMP%\smtmp\1\programs\accessories\tablet pc\windows journal.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\tabtip.lnk to %TEMP%\smtmp\1\programs\accessories\tablet pc\tabtip.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\shapecollector.lnk to %TEMP%\smtmp\1\programs\accessories\tablet pc\shapecollector.lnk
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer reports.lnk to %TEMP%\smtmp\1\programs\accessories\system tools\windows easy transfer reports.lnk
- from C:\users\public\desktop\steam.lnk to %TEMP%\smtmp\4\steam.lnk
Moves itself
- from <Full path to file> to %TEMP%\tmp1100.tmp
Network activity
Connects to
- 'se####yourself.org':80
TCP
HTTP GET requests
- http://se####yourself.org/404.php?ty###################################
UDP
- DNS ASK cl###bought.org
- DNS ASK se####widely.org
- DNS ASK fi###urface.org
- DNS ASK fi###hey.org
- DNS ASK se####yourself.org
- DNS ASK fi###ank.org
- DNS ASK fi###ncle.org
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\yqojeiajcihtx.exe'
Executes the following
- '%WINDIR%\syswow64\attrib.exe' +h "%HOMEPATH%\*.* " /s /d
- '%WINDIR%\syswow64\attrib.exe' +h "%HOMEPATH%\*.* " /s /d' (with hidden window)