Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '极品桌面' = '%PROGRAM_FILES%\550d8jpdesk\jpdesk.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ј«Ж·ЧАГж' = '%PROGRAM_FILES%\550d8jpdesk\jpdesk.exe /autorun'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\550d8jpdesk\jpdesk.exe /NoWizard /AddGame /AddShop /Addtuangou /DisableBorder /DisableShowNav /DisableTrainTick
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\550d8jpdesk\Background\У«Д»\background.ini
- %PROGRAM_FILES%\550d8jpdesk\Background\У«Д»\bg.png
- %PROGRAM_FILES%\550d8jpdesk\Background\НёГч\background_Horz.png
- %PROGRAM_FILES%\550d8jpdesk\Background\НёГч\separator_Vert.png
- %ALLUSERSPROFILE%\Start Menu\ј«Ж·ЧАГж.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ј«Ж·ЧАГж.lnk
- %PROGRAM_FILES%\550d8jpdesk\Background\У«Д»\separator.png
- %TEMP%\UpdateInfo.exe
- %PROGRAM_FILES%\550d8jpdesk\Background\А¶ВМ\background_bottom.png
- %PROGRAM_FILES%\550d8jpdesk\Background\А¶ВМ\separator bottom.png
- %PROGRAM_FILES%\550d8jpdesk\Background\ЅрКф\separator bottom.png
- %PROGRAM_FILES%\550d8jpdesk\Background\А¶ВМ\background.ini
- %PROGRAM_FILES%\550d8jpdesk\Background\МїєЪ\separator.png
- %PROGRAM_FILES%\550d8jpdesk\Background\НёГч\background.ini
- %PROGRAM_FILES%\550d8jpdesk\Background\МїєЪ\background.ini
- %PROGRAM_FILES%\550d8jpdesk\Background\МїєЪ\bg.png
- %TEMP%\5.tmp
- %APPDATA%\JPDesk\jpdesk.ini
- %TEMP%\4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\info[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\softexpress[1].ini
- %TEMP%\7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tools.jpdesk[1]
- %TEMP%\6.tmp
- %TEMP%\nsc3.tmp\NSISdl.dll
- %TEMP%\instmp.tmp
- %ALLUSERSPROFILE%\Desktop\ј«Ж·ЧАГж.lnk
- %APPDATA%\JPDesk\mods.ini
- %APPDATA%\JPDesk\CurTheme.Theme
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\onlineshopping[1]
- %PROGRAM_FILES%\550d8jpdesk\uninst.exe
- %PROGRAM_FILES%\550d8jpdesk\jpborder.exe
- %PROGRAM_FILES%\550d8jpdesk\PicLib\Misc Icons\Setting.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\Lock.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\Misc Icons\ChangeSkin.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\Misc Icons\Schedule.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\NetWork.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\Progress_Back.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\MyComputer.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\MyDocument.png
- %TEMP%\nsc3.tmp\KillProcDLL.dll
- %PROGRAM_FILES%\550d8jpdesk\jpdesk.exe
- %TEMP%\nsx2.tmp
- %TEMP%\nsc3.tmp\nsWebJPDesk.dll
- %PROGRAM_FILES%\550d8jpdesk\Default.png.tmp
- %PROGRAM_FILES%\550d8jpdesk\updateinfo.txt.tmp
- %PROGRAM_FILES%\550d8jpdesk\Update\jpborder.exe
- %PROGRAM_FILES%\550d8jpdesk\poof.png.tmp
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\jpxiaoshuo.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\msnmsgr.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\iexplore.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\jpgames.png
- %PROGRAM_FILES%\550d8jpdesk\Background\ЅрКф\background.ini
- %PROGRAM_FILES%\550d8jpdesk\Background\ЅрКф\background_bottom.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\taobao.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\wmplayer.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\Recycle_Full.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\Recycle_empty.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\Progress_Top.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\QQ.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\TrainTick.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\folder.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\SearchPage.png
- %PROGRAM_FILES%\550d8jpdesk\PicLib\System\Shop.png
Deletes the following files:
- %TEMP%\5.tmp
- %TEMP%\4.tmp
- %TEMP%\6.tmp
- %APPDATA%\JPDesk\CurTheme.Theme.bak
- %APPDATA%\JPDesk\CurTheme.Theme
- %TEMP%\nsc3.tmp\NSISdl.dll
- %TEMP%\nsc3.tmp\KillProcDLL.dll
- %PROGRAM_FILES%\550d8jpdesk\Update\jpborder.exe
- %TEMP%\nsc3.tmp\nsWebJPDesk.dll
Moves the following files:
- from %PROGRAM_FILES%\550d8jpdesk\updateinfo.txt.tmp to %PROGRAM_FILES%\550d8jpdesk\updateinfo.txt
- from %PROGRAM_FILES%\550d8jpdesk\Default.png.tmp to %PROGRAM_FILES%\550d8jpdesk\Default.png
- from %PROGRAM_FILES%\550d8jpdesk\poof.png.tmp to %PROGRAM_FILES%\550d8jpdesk\poof.png
Network activity:
Connects to:
- 'in##.##date.jpdesk.com':80
- 'to###.jpdesk.com':80
- 'in##.pc2.cc':80
- 'de####t.jpdesk.com':80
- 'jp##.pc2.cc':80
- 'localhost':1038
- 'tj.##desk.com':80
TCP:
HTTP GET requests:
- to###.jpdesk.com/?op########
- tj.##desk.com/?da####################################################################################################################
- in##.pc2.cc/jpdesk/softexpress.ini
- in##.##date.jpdesk.com/info/?28
- jp##.pc2.cc/?da#######################################################################
- tj.##desk.com/?da#######################################################################
- de####t.jpdesk.com/onlineshopping
UDP:
- DNS ASK to###.jpdesk.com
- DNS ASK in##.#j.jpdesk.com
- DNS ASK in##.pc2.cc
- DNS ASK in##.##date.jpdesk.com
- DNS ASK jp##.pc2.cc
- DNS ASK tj.##desk.com
- DNS ASK de####t.jpdesk.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'TfrmWeather' WindowName: '????'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'TfrmCalendar' WindowName: '??'
- ClassName: 'TfrmMain' WindowName: 'DockBar'
- ClassName: 'Indicator' WindowName: ''