Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ws7s' = '%APPDATA%\zf2c.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Inoyikotadoqev' = 'rundll32.exe "%WINDIR%\kbetomsv.dll",Startup'
- [<HKLM>\SYSTEM\ControlSet001\Control\Print\Providers\903632032] 'Name' = '%TEMP%\5.tmp'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\MouseDriver] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- %TEMP%\yttwulhw.exe
- %TEMP%\xqcwsah.exe
- %TEMP%\ukrycny.exe
- %TEMP%\pshha.exe
- %TEMP%\tcomfpag.exe
- %APPDATA%\zf2c.exe
- %TEMP%\mish.exe
- %APPDATA%\zf2c.exe -d2C3F56BC4C8B7DA25CAD587FCD89A4A12DB85929AECC945DE68AD4A2904638505824A2BFF38FE5BB146066C9033DE0C8DB1828C0B51E217D566F403C136C5624074E76D9D4DC2BC780C1672030CBC9C3D3E42A66F2439C9C49FB345CCF3B5ADC5700796BF6E841F1CD0BD483E82B9FCA51ECA99A8AD198AF0C2EC987790724E6A3B5963F9DDF57836958673401C5E564D23F2E2EE2E3E5AA2BB0570805DBD50989ECF4894E28DFC0005718428F125AC5157E80339EBB945E757879F6AAEECF2AE798FDEFCF8389707F0F20BAE776015114AAAAEFA4EAF68AF5160696DB1DB265D8645B57239147F61312F8699F55195A0F3AF5DC186B9C28F949179F4FB45F34BA54F55F91194AFE2ACD59658BC223E58020E9D0604F57CC0D3A074FF954F8C22B67F5029CD7023F704E3D42C1DFE20E27F150EA21A3390800336D1A0F76DDAF0648C4BE0BEF209FD2C3DC91955456B1FEF532723FBA916DDD74224806E2AFD7690C0B16E2FC973C7DAFAFF39C4ABFD845EAD8B0E0B3F1C2F2094155931350EBB29DB304660A9664DFA96FE2AC599F267668CC8D68822B46CC0921B2AB61DF277CF4E5591DBF8EDFA431156AD906B77251DBD61A7E534F9337155CC582C2C038A63E0A18CA4E3116B91EDB6678D60878D03C0078057CAD1441FECA448F6D918B4BA6CBE8749870804B6238AE1FE3D254330A92C1224CD82D37D28644
- %TEMP%\nohfx.exe
- %TEMP%\iycclejs.exe
- %TEMP%\cpbdrxur.exe
- %TEMP%\nsm3.tmp\IR.exe
- %TEMP%\nsm3.tmp\taskmgr.exe
- %TEMP%\qwutu.exe
- %TEMP%\nsm3.tmp\6tbp.exe
- %TEMP%\nsm3.tmp\1EuroP.exe
- %TEMP%\nsm3.tmp\2IC.exe
- %TEMP%\nsm3.tmp\3E4U - Bucks.exe
- %TEMP%\-1998166001
- %TEMP%\hodwarf.exe
- %TEMP%\cpbdrxur.exe (downloaded from the Internet)
- %TEMP%\hodwarf.exe (downloaded from the Internet)
- %TEMP%\xqcwsah.exe (downloaded from the Internet)
- %TEMP%\mish.exe (downloaded from the Internet)
- %TEMP%\nohfx.exe (downloaded from the Internet)
- %TEMP%\iycclejs.exe (downloaded from the Internet)
- %TEMP%\tcomfpag.exe (downloaded from the Internet)
- %TEMP%\yttwulhw.exe (downloaded from the Internet)
- %TEMP%\ukrycny.exe (downloaded from the Internet)
- %TEMP%\pshha.exe (downloaded from the Internet)
- %TEMP%\-1998166001 (downloaded from the Internet)
- %TEMP%\qwutu.exe (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\runonce.exe -r
- <SYSTEM32>\rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 %APPDATA%\mdinstall.inf
- <SYSTEM32>\net1.exe stop "Windows Firewall/Internet Connection Sharing (ICS)"
- <SYSTEM32>\grpconv.exe -o
- <SYSTEM32>\rundll32.exe "%WINDIR%\kbetomsv.dll",iep
- <SYSTEM32>\cmd.exe /c "%APPDATA%\2v92w5c10.bat"
- <SYSTEM32>\net1.exe stop "Security Center"
- <SYSTEM32>\net.exe stop "Security Center"
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\rundll32.exe "%WINDIR%\kbetomsv.dll",Startup
- <SYSTEM32>\sc.exe config SharedAccess start= DISABLED
- <SYSTEM32>\net.exe stop "Windows Firewall/Internet Connection Sharing (ICS)"
- <SYSTEM32>\sc.exe config wscsvc start= DISABLED
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\spoolsv.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'currentlevel' = '00000000'
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ivzqmqd[1].php
- %TEMP%\xqcwsah.exe
- %TEMP%\iycclejs.exe
- %TEMP%\cpbdrxur.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\oobbff[1].php
- %APPDATA%\zf2c.exe
- %TEMP%\ukrycny.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\sjwxkob[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\arboobnkar[1].php
- %TEMP%\yttwulhw.exe
- %APPDATA%\MouseDriver.bat
- %APPDATA%\2v92w5c10.bat
- %TEMP%\mish.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hdqhyyz[1].php
- %WINDIR%\oqoyanamisuno.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\CAQZ6R2L.php
- %APPDATA%\mdinstall.inf
- %TEMP%\Aqz..bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\nnbrswmqa[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\flcppgggu[1].php
- %TEMP%\nohfx.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\dnnrvriqm[1].php
- %TEMP%\nsm3.tmp\IR.exe
- %TEMP%\nsm3.tmp\6tbp.exe
- %WINDIR%\kbetomsv.dll
- %TEMP%\4.tmp
- %TEMP%\nsm3.tmp\taskmgr.exe
- %TEMP%\nsl2.tmp
- %TEMP%\nsm3.tmp\1EuroP.exe
- %TEMP%\nsm3.tmp\3E4U - Bucks.exe
- %TEMP%\nsm3.tmp\2IC.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\qduhhl[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\xtkkbspt[1].php
- %TEMP%\hodwarf.exe
- %TEMP%\pshha.exe
- %TEMP%\tcomfpag.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\qqqriimq[1].php
- %WINDIR%\Temp\6.tmp
- %TEMP%\qwutu.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\erfjjje[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\dhdhuy[1].php
- %TEMP%\-1998166001
Sets the 'hidden' attribute to the following files:
- %APPDATA%\MouseDriver.bat
Deletes the following files:
- <DRIVERS>\etc\hosts
- %TEMP%\5.tmp
- %WINDIR%\Temp\6.tmp
- <SYSTEM32>\svchost.exe
- %APPDATA%\mdinstall.inf
- %TEMP%\nsm3.tmp\2IC.exe
- %TEMP%\nsm3.tmp\1EuroP.exe
- %TEMP%\nsm3.tmp\3E4U - Bucks.exe
- %TEMP%\nsm3.tmp\taskmgr.exe
- %TEMP%\nsm3.tmp\IR.exe
Moves the following files:
- from %TEMP%\4.tmp to %TEMP%\5.tmp
Network activity:
Connects to:
- '07######1038.kaylith.net':80
- 'w.#####ardiscover.com':888
- 'localhost':1042
- 'aa###ket.com':80
- 'fi##do.in':80
TCP:
HTTP GET requests:
- aa###ket.com/ckkuylpycc/oobbff.php?ad####################################
- aa###ket.com/ckkuylpycc/ivzqmqd.php?ad####################################
- aa###ket.com/ckkuylpycc/arboobnkar.php?ad####################################
- aa###ket.com/ckkuylpycc/hdqhyyz.php?ad##################################################################
- aa###ket.com/ckkuylpycc/flcppgggu.php?ad####################################
- aa###ket.com/ckkuylpycc/nnbrswmqa.php?ad####################################
- aa###ket.com/ckkuylpycc/sjwxkob.php?ad####################################
- aa###ket.com/ckkuylpycc/dhdhuy.php?ad####################################
- aa###ket.com/ckkuylpycc/qduhhl.php?ad####################################
- aa###ket.com/ckkuylpycc/erfjjje.php?ad####################################
- aa###ket.com/ckkuylpycc/dnnrvriqm.php?ad####################################
- aa###ket.com/ckkuylpycc/qqqriimq.php?ad####################################
- aa###ket.com/ckkuylpycc/xtkkbspt.php?ad####################################
UDP:
- DNS ASK fi##do.in
- DNS ASK 07######1038.kaylith.net
- DNS ASK w.#####ardiscover.com
- DNS ASK aa###ket.com
- DNS ASK ti##pic.com
- DNS ASK ma##h.com
- DNS ASK da##.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'CSCHiddenWindow' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''