Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\win.ini
Malicious functions:
Executes the following:
- '<LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\local\stubexe\0x93CBA7D3E054902F\FocusMagic.exe'
Modifies file system:
Creates the following files:
- %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\x86_JR.Inno.Setup@1.0.0.0\x86_JR.Inno.Setup@1.0.0.0.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\x86_JR.Inno.Setup@1.0.0.0\JR.Inno.Setup.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\unins000.exe_0x95adfaa51d0a6f76d787abf3ba99e180.1.manifest.__tmp__
- <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\local\temp\@APPDATA@\Microsoft\HTML Help\hh.dat
- %TEMP%\~DF3D14.tmp
- %TEMP%\~DF3C74.tmp
- <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\roaming\meta\@APPDATA@\Microsoft\HTML Help\hh.dat.__meta__.__tmp__
- <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\local\stubexe\0x93CBA7D3E054902F\FocusMagic.exe.manifest.__tmp__
- <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\local\stubexe\0x93CBA7D3E054902F\FocusMagic.exe.__tmp__
- <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\xsandbox.bin.__tmp__
- %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FocusMag64.dll_0xbbf9210d30c67ee4df15cbbe30cd7484.2.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FreeImage.dll_0x053545e13c75d15047ee3eaaf70da33e.2.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FocusMagic64.8bf_0xa867734b22196a7d5bdecaab0641b6e3.2.manifest.__tmp__
- %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FocusMagic.8bf_0x6951e2eb59500bdff55c1ddd2891a30f.2.manifest.__tmp__
Moves the following files:
- from %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\x86_JR.Inno.Setup@1.0.0.0\JR.Inno.Setup.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\x86_JR.Inno.Setup@1.0.0.0\JR.Inno.Setup.manifest
- from %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\unins000.exe_0x95adfaa51d0a6f76d787abf3ba99e180.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\unins000.exe_0x95adfaa51d0a6f76d787abf3ba99e180.1.manifest
- from %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FreeImage.dll_0x053545e13c75d15047ee3eaaf70da33e.2.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FreeImage.dll_0x053545e13c75d15047ee3eaaf70da33e.2.manifest
- from <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\roaming\meta\@APPDATA@\Microsoft\HTML Help\hh.dat.__meta__.__tmp__ to <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\roaming\meta\@APPDATA@\Microsoft\HTML Help\hh.dat.__meta__
- from <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\local\temp\@APPDATA@\Microsoft\HTML Help\hh.dat to <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\roaming\modified\@APPDATA@\Microsoft\HTML Help\hh.dat
- from %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\x86_JR.Inno.Setup@1.0.0.0\x86_JR.Inno.Setup@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\x86_JR.Inno.Setup@1.0.0.0\x86_JR.Inno.Setup@1.0.0.0.manifest
- from <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\local\stubexe\0x93CBA7D3E054902F\FocusMagic.exe.manifest.__tmp__ to <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\local\stubexe\0x93CBA7D3E054902F\FocusMagic.exe.manifest
- from <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\local\stubexe\0x93CBA7D3E054902F\FocusMagic.exe.__tmp__ to <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\local\stubexe\0x93CBA7D3E054902F\FocusMagic.exe
- from <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\xsandbox.bin.__tmp__ to <LS_APPDATA>\Turbo.net\Sandbox\Focus Magic\4.02\xsandbox.bin
- from %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FocusMagic64.8bf_0xa867734b22196a7d5bdecaab0641b6e3.2.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FocusMagic64.8bf_0xa867734b22196a7d5bdecaab0641b6e3.2.manifest
- from %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FocusMagic.8bf_0x6951e2eb59500bdff55c1ddd2891a30f.2.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FocusMagic.8bf_0x6951e2eb59500bdff55c1ddd2891a30f.2.manifest
- from %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FocusMag64.dll_0xbbf9210d30c67ee4df15cbbe30cd7484.2.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x6128973788EFBE36\sxs\Manifests\FocusMag64.dll_0xbbf9210d30c67ee4df15cbbe30cd7484.2.manifest
Network activity:
Connects to:
- 'st###.spoon.net':443
UDP:
- DNS ASK st###.spoon.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Focus Magic Frame Window Class' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
