Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\uuupgrade\shell\open\command] '' = '"%CommonProgramFiles%\uusee\UUUpgrade.exe"'
- [<HKLM>\SOFTWARE\Classes\UUTRAN\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeeClient.exe" "%1"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UUSeeMediaCenter' = '"%CommonProgramFiles%\uusee\UUSeeMediaCenter.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ColorCursor' = '%PROGRAM_FILES%\ColorCursor\Cursor.exe autostart'
- [<HKLM>\SOFTWARE\Classes\UUSEE\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeeClient.exe" -url "%1"'
- [<HKLM>\SOFTWARE\Classes\UUTRAN\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeeClient.exe" -url "%1"'
Creates or modifies the following files:
- %WINDIR%\Tasks\uuseeupdatetask.job
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\UUSee Live Update Service] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\pwifl_30287.exe' = 'C:\pwifl_30287.exe:*:Enabled:百度杀毒在线安装程序'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] 'C:\pwifl_30287.exe' = 'C:\pwifl_30287.exe:*:Enabled:百度杀毒在线安装程序'
Creates and executes the following:
- '%TEMP%\nsi6.tmp\ns9.tmp' "%CommonProgramFiles%\uusee\UUSeeLUS.exe " -u
- '%CommonProgramFiles%\uusee\UUUpgrade.exe' -i UUPlayer_2011
- '%CommonProgramFiles%\uusee\UUSeeLUS.exe' -k
- '%PROGRAM_FILES%\uusee\UUSeeClient.exe' -minimize
- '%TEMP%\nsi6.tmp\ns8.tmp' "%CommonProgramFiles%\uusee\UUSeeLUS.exe " -k
- '%TEMP%\sckj.exe' %CommonProgramFiles%\uusee\UUSeeMediaCenter.exe
- '%CommonProgramFiles%\uusee\UUSeeMediaCenter.exe' -handle 131400
- '%CommonProgramFiles%\uusee\UUSeeLUS.exe' -i
- '%CommonProgramFiles%\uusee\UUSeeLUS.exe' -u
- '%TEMP%\nsi6.tmp\nsA.tmp' "%CommonProgramFiles%\uusee\UUSeeLUS.exe " -i
- 'C:\UUSEE_lmqn_Setup_1002.exe'
- '%TEMP%\setup.exe' /VERYSILENT /SP-
- 'C:\pwifl_30287.exe'
- 'C:\setup_3322.exe'
- 'C:\xkcc_50091167642.exe'
- '%TEMP%\nsi6.tmp\ns7.tmp' schtasks /create /tn uuseeupdatetask /tr "\"%CommonProgramFiles%\uusee\UUUpgrade.exe\" -i UUPlayer_2011" /sc onlogon /RU SYSTEM
- '%PROGRAM_FILES%\ColorCursor\Cursor.exe' installstart
- '%PROGRAM_FILES%\yyfm0529\2014062316\YFMSever.exe'
- '%TEMP%\is-B845B.tmp\setup.tmp' /SL5="$20102,1238587,54272,%TEMP%\setup.exe" /VERYSILENT /SP-
- '%PROGRAM_FILES%\yyfm0529\2014062316\yymusic05.exe' -tuopan
Executes the following:
- '<SYSTEM32>\schtasks.exe' /create /tn uuseeupdatetask /tr "\"%CommonProgramFiles%\uusee\UUUpgrade.exe\" -i UUPlayer_2011" /sc onlogon /RU SYSTEM
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\uusee\UUSeeClient.exe
- %PROGRAM_FILES%\uusee\skin.zip
- %PROGRAM_FILES%\uusee\uninstuusee.exe
- %PROGRAM_FILES%\uusee\UUDesktopPP.exe
- %CommonProgramFiles%\uusee\UUSeeLUS.exe
- %CommonProgramFiles%\uusee\UUPlayer_2011_path.ini
- %PROGRAM_FILES%\uusee\UUDesktopMN.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\УЖКУЦ±ІҐ\Жф¶ЇУЖКУЦ±ІҐ.lnk
- %PROGRAM_FILES%\uusee\UUSee.url
- %ALLUSERSPROFILE%\Start Menu\Programs\УЖКУЦ±ІҐ\·ГОКUUSee НшХѕ.lnk
- %PROGRAM_FILES%\uusee\UUDesktop\skin\wk_state_logo.png
- %PROGRAM_FILES%\uusee\UUDesktop\skin\state.html
- %PROGRAM_FILES%\uusee\UUDesktop\skin\wk_state.jpg
- %PROGRAM_FILES%\uusee\UUDesktop\skin\wk_state.png
- %PROGRAM_FILES%\uusee\UUPlayer_2014_update.ini
- %CommonProgramFiles%\uusee\UUUpgrade.exe
- %CommonProgramFiles%\uusee\trafficlight.dll
- %CommonProgramFiles%\uusee\UUSeeMediaCenter.exe
- %CommonProgramFiles%\uusee\UUNet.dll
- %CommonProgramFiles%\uusee\StartService.ocx
- %CommonProgramFiles%\uusee\npstartservicep.dll
- %CommonProgramFiles%\uusee\in_net.dll
- %PROGRAM_FILES%\uuseeweb.ico
- %CommonProgramFiles%\uusee\uninst.exe
- %CommonProgramFiles%\uusee\LocalInfo.ini
- %PROGRAM_FILES%\zhibo.ico
- %CommonProgramFiles%\uusee\MediaCenter.ini
- %CommonProgramFiles%\uusee\UUUpgrade.ini
- %CommonProgramFiles%\uusee\Localserver.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\УЖКУЦ±ІҐ\Р¶ФШУЖКУЦ±ІҐ.lnk
- %PROGRAM_FILES%\uusee\skin\loading\loading.html
- %PROGRAM_FILES%\uusee\skin\localpage.ini
- %PROGRAM_FILES%\uusee\skin\nav.html
- %PROGRAM_FILES%\uusee\skin\loading\loading.gif
- %TEMP%\nsi6.tmp\nsA.tmp
- %PROGRAM_FILES%\uusee\skin\history_img\ds_bj.jpg
- %PROGRAM_FILES%\uusee\skin\loading\ds_bj.jpg
- %PROGRAM_FILES%\uusee\skin\player1.js
- %PROGRAM_FILES%\uusee\skin\setting.html
- %PROGRAM_FILES%\uusee\skin\state.html
- %TEMP%\sckj.exe
- %CommonProgramFiles%\desktop\desktopiconX86.dll
- %PROGRAM_FILES%\uusee\skin\nav_img\k_ioc.png
- %PROGRAM_FILES%\uusee\skin\player.js
- %PROGRAM_FILES%\uusee\skin\history.html
- %PROGRAM_FILES%\Mozilla Firefox\plugins\npuuseep.dll
- %PROGRAM_FILES%\Mozilla Firefox\plugins\npstartservicep.dll
- %TEMP%\nsi6.tmp\Math.dll
- %ALLUSERSPROFILE%\Desktop\УЖКУЦ±ІҐ.lnk
- %ALLUSERSPROFILE%\Start Menu\УЖКУЦ±ІҐ.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\УЖКУЦ±ІҐ.lnk
- %ALLUSERSPROFILE%\Desktop\УЖКУНш.lnk
- %TEMP%\nsi6.tmp\ns8.tmp
- %TEMP%\nsi6.tmp\ns9.tmp
- %PROGRAM_FILES%\uusee\skin\func.html
- %PROGRAM_FILES%\ColorCursor\DownLoad.ini
- %TEMP%\nsi6.tmp\nsExec.dll
- %TEMP%\nsi6.tmp\ns7.tmp
- %PROGRAM_FILES%\ColorCursor\Malware.log
- %PROGRAM_FILES%\yyfm0529\2014062316\Data\setup.ini
- %PROGRAM_FILES%\yyfm0529\2014062316\Data\version.ini
- %PROGRAM_FILES%\yyfm0529\2014062316\DuiLib.dll
- %PROGRAM_FILES%\yyfm0529\2014062316\Data\dh.ini
- %PROGRAM_FILES%\yyfm0529\2014062316\avutil-52.dll
- %PROGRAM_FILES%\yyfm0529\2014062316\channels.xml
- %PROGRAM_FILES%\yyfm0529\2014062316\Data\client.ini
- %PROGRAM_FILES%\yyfm0529\2014062316\swresample-0.dll
- %PROGRAM_FILES%\yyfm0529\2014062316\SysConfig.ini
- %PROGRAM_FILES%\yyfm0529\2014062316\Unins.exe
- %PROGRAM_FILES%\yyfm0529\2014062316\source.dll
- %PROGRAM_FILES%\yyfm0529\2014062316\favorfm.xml
- %PROGRAM_FILES%\yyfm0529\2014062316\libav.dll
- %PROGRAM_FILES%\yyfm0529\2014062316\pthreadGC2.dll
- %PROGRAM_FILES%\yyfm0529\2014062316\avformat-54.dll
- %TEMP%\setup.exe
- %TEMP%\nsw2.tmp
- %TEMP%\nsc5.tmp
- C:\setup_3322.exe
- C:\UUSEE_lmqn_Setup_1002.exe
- C:\xkcc_50091167642.exe
- C:\pwifl_30287.exe
- %PROGRAM_FILES%\yyfm0529\2014062316\avcodec-54.dll
- %PROGRAM_FILES%\yyfm0529\2014062316\avcore.dll
- %TEMP%\nsc3.tmp\BDMSkin.dll
- %PROGRAM_FILES%\yyfm0529\2014062316\audio.dll
- %TEMP%\nsi6.tmp\System.dll
- %TEMP%\nsc3.tmp\System.dll
- %TEMP%\nsc3.tmp\res\onlineWnd.zip
- %PROGRAM_FILES%\yyfm0529\2014062316\YFMSever.exe
- %PROGRAM_FILES%\ColorCursor\is-DS3PD.tmp
- %PROGRAM_FILES%\ColorCursor\is-FL0SL.tmp
- %PROGRAM_FILES%\ColorCursor\is-A96C9.tmp
- %PROGRAM_FILES%\ColorCursor\is-R9DQ0.tmp
- %TEMP%\is-AA8DI.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-AA8DI.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-AA8DI.tmp\InstallerDLL.dll
- %PROGRAM_FILES%\ColorCursor\unins000.dat
- %ALLUSERSPROFILE%\Application Data\Baidu\Common\Global.db
- %TEMP%\nsi6.tmp\AccessControl.dll
- %ALLUSERSPROFILE%\Desktop\№вмЕКу±к.lnk
- %PROGRAM_FILES%\ColorCursor\is-FBDMJ.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\№вмЕКу±к\№вмЕКу±к.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\№вмЕКу±к\Р¶ФШ№вмЕКу±к.lnk
- %PROGRAM_FILES%\yyfm0529\2014062316\Data\user2.ini
- %TEMP%\nsc3.tmp\hu.dll
- %TEMP%\nsc3.tmp\BDLogicUtils.dll
- %TEMP%\nsc3.tmp\BDMNetGetInfo.dll
- %TEMP%\nsi6.tmp\FindProcDLL.dll
- %PROGRAM_FILES%\yyfm0529\2014062316\yymusic05.exe
- %TEMP%\nsc3.tmp\BDMDownload.dll
- %TEMP%\nsc3.tmp\dl.dll
- %HOMEPATH%\Start Menu\Programs\yyfm0529\№Щ·ЅЦчТі.lnk
- %TEMP%\nsi6.tmp\UUSeeLog.dll
- %HOMEPATH%\Start Menu\Programs\yyfm0529\ЕдЦГ№¤ѕЯ\Р¶ФШyyfm0529.lnk
- <SYSTEM32>\nsis_loader.dll
- %HOMEPATH%\Start Menu\Programs\yyfm0529\yyfm0529.lnk
- %TEMP%\is-B845B.tmp\setup.tmp
- %TEMP%\nsc3.tmp\tmp7wtmdh.dll
Deletes the following files:
- %TEMP%\nsi6.tmp\AccessControl.dll
- %TEMP%\nsi6.tmp\FindProcDLL.dll
- %TEMP%\nsi6.tmp\nsA.tmp
- %TEMP%\sckj.exe
- %TEMP%\nsi6.tmp\System.dll
- %TEMP%\nsi6.tmp\UUSeeLog.dll
- %TEMP%\nsi6.tmp\Math.dll
- %TEMP%\nsi6.tmp\nsExec.dll
- %TEMP%\nsi6.tmp\ns9.tmp
- %TEMP%\is-AA8DI.tmp\InstallerDLL.dll
- %TEMP%\is-AA8DI.tmp\_isetup\_RegDLL.tmp
- <SYSTEM32>\nsis_loader.dll
- %PROGRAM_FILES%\uusee\UUPlayer_2014_update.ini
- %TEMP%\nsi6.tmp\ns7.tmp
- %TEMP%\nsi6.tmp\ns8.tmp
- %TEMP%\is-AA8DI.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-B845B.tmp\setup.tmp
Moves the following files:
- from %PROGRAM_FILES%\ColorCursor\is-A96C9.tmp to %PROGRAM_FILES%\ColorCursor\Malware.dll
- from %PROGRAM_FILES%\ColorCursor\is-FBDMJ.tmp to %PROGRAM_FILES%\ColorCursor\UpdateFile.exe
- from %PROGRAM_FILES%\ColorCursor\is-FL0SL.tmp to %PROGRAM_FILES%\ColorCursor\InstallerDLL.dll
- from %PROGRAM_FILES%\ColorCursor\is-R9DQ0.tmp to %PROGRAM_FILES%\ColorCursor\unins000.exe
- from %PROGRAM_FILES%\ColorCursor\is-DS3PD.tmp to %PROGRAM_FILES%\ColorCursor\Cursor.exe
Network activity:
Connects to:
- 'localhost':1051
- 'localhost':1048
- '12#.#25.114.144':80
UDP:
- DNS ASK wh###.#conline.com.cn
- DNS ASK in#.###ol.sina.com.cn
- DNS ASK uh##.uusee.com
- DNS ASK uu###.adsame.com
- DNS ASK ne####.uusee.com
- DNS ASK pl####.uusee.com
- DNS ASK lo#.#usee.com
- DNS ASK p.#.#aidu.com
- DNS ASK lo####ver.uusee.com
- DNS ASK up####.yinyue.fm
- DNS ASK sh###.baidu.com
- DNS ASK ji####.shuafenba.com
- '34.#.23.1':10110
- '0.###.253.127':18100
- 'lo####ver.uusee.com':17200
- 'lo#.#usee.com':17200
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'OnLineWnd' WindowName: '(null)'