Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\d7ii\config\reg.settings.dat
- %HOMEPATH%\desktop\d7ii\config\ftp.settings.dat
- %HOMEPATH%\desktop\d7ii\config\email.settings.dat
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\d7ii\config\sortorder\custommaint
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\mcafee stinger (silent-offline).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\mcafee stinger.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\microsoft fixit portable.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\microsoft fixit win update (auto).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\microsoft fixit winsock (auto).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\ms office config analyzer tool (install).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\ms office config analyzer tool (portable).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\neutron (sync time).cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\offlinebox1.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\openhardwaremonitor.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\mbrcheck (report only).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\otl.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\patchmypc.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\piriform ccleaner (auto).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\piriform ccleaner.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\piriform defraggler (auto).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\piriform defraggler.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\piriform recuva.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\piriform speccy.cfg
- %HOMEPATH%\desktop\d7ii\config\profiles\quick.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\repairbox1.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\repairbox2.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\mcafee stinger (offline).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\mcafee stinger (silent).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\mbrcheck.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\mbrcheck (offline).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\revo uninstaller.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\everything search engine.cfg
- %HOMEPATH%\desktop\d7ii\config\profiles\full.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\gmer.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\google chrome software removal tool.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\herdprotect (uninstall).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\herdprotect.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\hitmanpro (manual).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\hitmanpro.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\jrt.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\repairbox3.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\emsisoft a2cmd update.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\patchmypc (auto).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\kaspersky tdsskiller (silent).cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\maintbox3.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\malwarebox1.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\malwarebox2.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\malwarebox3.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\malwarebytes (full).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\malwarebytes (quick).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\malwarebytes anti-rootkit.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\malwarebytes v2.cfg
- %HOMEPATH%\desktop\d7ii\config\intfunctions\mbam_prefs.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\kaspersky tdsskiller.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\maintbox1.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\maintbox2.cfg
- %HOMEPATH%\desktop\d7ii\config\d7ii_defaultapps.ini
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\rkill.cfg
- %HOMEPATH%\desktop\d7ii\modules\dfunk.exe
- %HOMEPATH%\desktop\d7ii\modules\ets.exe
- %HOMEPATH%\desktop\d7ii\modules\filehandler.exe
- %HOMEPATH%\desktop\d7ii\modules\goog.exe
- %HOMEPATH%\desktop\d7ii\modules\ifeo_dummy.exe
- %HOMEPATH%\desktop\d7ii\modules\ifeo_silent_dummy.exe
- %HOMEPATH%\desktop\d7ii\modules\locksmith.exe
- %HOMEPATH%\desktop\d7ii\modules\malwarescan.exe
- %HOMEPATH%\desktop\d7ii\modules\mapdrives.exe
- %HOMEPATH%\desktop\d7ii\modules\msdfix.exe
- %HOMEPATH%\desktop\d7ii\3rd party tools\neutron\neutron.exe
- %HOMEPATH%\desktop\d7ii\modules\delreg.exe
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\emsisoft a2cmd update (offline).cfg
- %HOMEPATH%\desktop\d7ii\config\sfx_mini\d7ii_sfx_mini.exe
- %HOMEPATH%\desktop\d7ii\3rd party tools\secedit.exe
- %HOMEPATH%\desktop\d7ii\3rd party tools\srvany.exe
- %HOMEPATH%\desktop\d7ii\modules\startupkill.exe
- %HOMEPATH%\desktop\d7ii\3rd party tools\subinacl.exe
- %HOMEPATH%\desktop\d7ii\modules\unloadreg.exe
- %HOMEPATH%\desktop\d7ii\modules\winsockreset.exe
- %HOMEPATH%\desktop\d7ii\modules\foolisheventlogmsghelper.dll
- %HOMEPATH%\desktop\d7ii\config\sfx_mini\ccrpprg6.ocx
- %HOMEPATH%\desktop\d7ii\codejock.controls.v15.3.1.ocx
- %HOMEPATH%\desktop\d7ii\modules\codejock.controls.v15.3.1.ocx
- %HOMEPATH%\desktop\d7ii\modules\rebootmaster.exe
- %HOMEPATH%\desktop\d7ii\3rd party tools\produkey-x64.exe
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\eset smart installer.cfg
- %HOMEPATH%\desktop\d7ii\modules\createsrp.exe
- %HOMEPATH%\desktop\d7ii\config\customapps\viprerescuescanner (quick scan).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\should i remove it.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\sophos virus removal tool.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\spacesniffer.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\startuplite.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\superantispyware.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\sysinternals pagedefrag (xp).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\tcpoptimizer.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\tweaksbox1.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\unchecky (install).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\viprerescuescanner (auto).cfg
- %HOMEPATH%\desktop\d7ii\d7ii.exe
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\rogue killer.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\should i remove it (uninstall).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\windows repair aio (auto).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\windows repair aio.cfg
- %HOMEPATH%\desktop\d7ii\config\email.settings.dat
- %HOMEPATH%\desktop\d7ii\config\ftp.settings.dat
- %HOMEPATH%\desktop\d7ii\config\reg.settings.dat
- %HOMEPATH%\desktop\d7ii\3rd party tools\7za.exe
- %HOMEPATH%\desktop\d7ii\3rd party tools\batteryinfoview.exe
- %HOMEPATH%\desktop\d7ii\modules\bootsafe.exe
- %HOMEPATH%\desktop\d7ii\modules\browser.exe
- %HOMEPATH%\desktop\d7ii\modules\cpustresshelper.exe
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\viprerescuescanner (manual).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\viprerescuescanner (deep scan).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\emsisoft a2cmd smart scan.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\emsisoft a2cmd quick scan.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\emsisoft a2cmd full scan.cfg
- %HOMEPATH%\desktop\d7ii\modules\defs\duninstaller_startmenufolders.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\duninstaller_whitelist.txt
- %HOMEPATH%\desktop\d7ii\config\templates\notes\equipment received.txt
- %HOMEPATH%\desktop\d7ii\config\folders.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\fsdefs_dirs_whitelist.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\fsdefs_files_whitelist.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\fshunt_driver_whitelist.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\fshunt_stddefs.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\fshunt_system32_whitelist.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\duninstaller_regkeys.txt
- %HOMEPATH%\desktop\d7ii\modules\locksmith.cmd
- %HOMEPATH%\desktop\d7ii\modules\defs\duninstaller_runvalues.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\fshunt_userdefs.txt
- %HOMEPATH%\desktop\d7ii\config\links.txt
- %HOMEPATH%\desktop\d7ii\config\templates\email\machine reports.txt
- %HOMEPATH%\desktop\d7ii\config\templates\snippets\maintenance completed.txt
- %HOMEPATH%\desktop\d7ii\config\templates\snippets\pc repair completed.txt
- %HOMEPATH%\desktop\d7ii\3rd party tools\neutron\readme.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\reghunt_bho_whitelist.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\reghunt_enumroot_whitelist.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\reghunt_knowndlls_whitelist.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\reghunt_lgnntfy_whitelist.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\fshunt_windir_whitelist.txt
- %HOMEPATH%\desktop\d7ii\config\templates\snippets\invoice.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\kea_whitelist.txt
- %HOMEPATH%\desktop\d7ii\richtx32.ocx
- %HOMEPATH%\desktop\d7ii\modules\defs\reghunt_minsvcs_whitelist.txt
- %HOMEPATH%\desktop\d7ii\config\templates\snippets\diagnostics completed.txt
- %HOMEPATH%\desktop\d7ii\config\os branding\applogo.jpg.jpg
- %HOMEPATH%\desktop\d7ii\config\applogo.png
- %HOMEPATH%\desktop\d7ii\config\d7ii_sfx_mini.bmp
- %HOMEPATH%\desktop\d7ii\config\itintegrityguy.bmp
- %HOMEPATH%\desktop\d7ii\config\sfx_mini\itintegrityguy.bmp
- %HOMEPATH%\desktop\d7ii\config\applogo.ico
- %HOMEPATH%\desktop\d7ii\config\customapps\3rd party configs\a2cmd.cmd
- %HOMEPATH%\desktop\d7ii\modules\delzbf.cmd
- %HOMEPATH%\desktop\d7ii\modules\findqs.cmd
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\3rd party configs\hmp.cmd
- %HOMEPATH%\desktop\d7ii\modules\defs\duninstaller.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\duninstaller_filesystemobjects.txt
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\3rd party configs\jrt_auto.cmd
- %HOMEPATH%\desktop\d7ii\config\templates\email\breakfix report.txt
- %HOMEPATH%\desktop\d7ii\config\templates\email\client diagnostic report.txt
- %HOMEPATH%\desktop\d7ii\config\templates\notes\company info.txt
- %HOMEPATH%\desktop\d7ii\config\templates\email\contract report.txt
- %HOMEPATH%\desktop\d7ii\d7ii_releasenotes.txt
- %HOMEPATH%\desktop\d7ii\config\templates\notes\detected infections.txt
- %HOMEPATH%\desktop\d7ii\modules\dfunk_releasenotes.txt
- %HOMEPATH%\desktop\d7ii\config\templates\snippets\diagnostics - maintenance needed.txt
- %HOMEPATH%\desktop\d7ii\config\templates\snippets\diagnostics - pc repair needed.txt
- %HOMEPATH%\desktop\d7ii\config\templates\snippets\diagnostics - virus detected.txt
- %HOMEPATH%\desktop\d7ii\config\profiles.zip
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\3rd party configs\rkill.cmd
- %HOMEPATH%\desktop\d7ii\modules\regbackup.exe
- %HOMEPATH%\desktop\d7ii\modules\defs\reghunt_run_whitelist.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\regkill_ccsvaldefs.txt
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\avast! aswmbr.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\avast! aswmbr_copy.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\batteryinfoview.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\batteryinfoview_copy.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\belarc advisor (install-report).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\belarc advisor (install-report)_copy.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\bitdefender rootkit remover.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\bitdefender rootkit remover_copy.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\bluescreenview.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\bluescreenview_copy.cfg
- %HOMEPATH%\desktop\d7ii\modules\defs\reghunt_svcs_whitelist.txt
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\autoruns.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\auslogics dd portable_copy.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\crowdinspect.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\crystaldiskinfo.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\d7iiendsession.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\d7iistartsession.cfg
- %HOMEPATH%\desktop\d7ii\config\profiles\diagnose and testing.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\emsisoft a2cmd - update and full scan.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\emsisoft a2cmd - update and offline scan.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\emsisoft a2cmd deep scan (offline).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\emsisoft a2cmd deep scan.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\emsisoft a2cmd full scan (offline).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\combofix (uninstall).cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\combofix_copy.cfg
- %HOMEPATH%\desktop\d7ii\modules\defs\regkill_ccsdefs.txt
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\combofix.cfg
- %HOMEPATH%\desktop\d7ii\modules\defs\duninstaller_regvalues.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\regkill_keydefs.txt
- %HOMEPATH%\desktop\d7ii\modules\defs\regkill_valdefs.txt
- %HOMEPATH%\desktop\d7ii\config\reglinks.txt
- %HOMEPATH%\desktop\d7ii\config\templates\email\reports.txt
- %HOMEPATH%\desktop\d7ii\config\sitesearch.txt
- %HOMEPATH%\desktop\d7ii\config\templates\notes\user info.txt
- %HOMEPATH%\desktop\d7ii\config\templates\snippets\virus removal completed.txt
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\3rd party configs\pagedfrg.reg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\3rd party configs\patchmypc.reg
- %HOMEPATH%\desktop\d7ii\config\alttext.ini
- %HOMEPATH%\desktop\d7ii\config\sortorder\auditbox1.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\auslogics dd portable.cfg
- %HOMEPATH%\desktop\d7ii\config\sortorder\auditbox2.cfg
- %HOMEPATH%\desktop\d7ii\config\sfx_mini\d7ii_sfx_mini.ini
- %HOMEPATH%\desktop\d7ii\config\customapps\3rd party configs\everything.ini
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\3rd party configs\neutron.ini
- %HOMEPATH%\desktop\d7ii\3rd party tools\neutron\neutron.ini
- %HOMEPATH%\desktop\d7ii\config\os branding\osbranding.ini
- %HOMEPATH%\desktop\d7ii\3rd party tools\ketarin\d7ii_defaultapps.db
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\adwcleaner.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\adwcleaner_copy.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps_d7ii\as ssd benchmark.cfg
- %HOMEPATH%\desktop\d7ii\config\customapps\as ssd benchmark_copy.cfg
- %HOMEPATH%\desktop\d7ii\config\d7ii.ini
- %HOMEPATH%\desktop\d7ii\config\d7ii_sfx_mini.ini
- %HOMEPATH%\desktop\d7ii\8675309.tmp
Deletes the following files
- %HOMEPATH%\desktop\d7ii\8675309.tmp
Network activity
UDP
- DNS ASK do####ad.d7ii.com
Miscellaneous
Searches for the following windows
- ClassName: 'softice' WindowName: ''
- ClassName: 'w32dasm' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\desktop\d7ii\d7ii.exe' /delsfx
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s "%HOMEPATH%\Desktop\d7II\Codejock.Controls.v15.3.1.ocx"