Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'cacaoweb' = '"%ProgramFiles%\cacaoweb\cacaoweb.exe" -noplayer'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\cacaoweb\cacaoweb.exe' = '%ProgramFiles%\cacaoweb\cacao...
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
- '%ProgramFiles%\cacaoweb\cacaoweb.exe' -reboot
Modifies file system:
Creates the following files:
- <LS_APPDATA>\Microsoft\Internet Explorer\MSIMGSIZ.DAT
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\featured[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\isloggedin[1].php
- %APPDATA%\cacaoweb\npdfile.dat
- %HOMEPATH%\Desktop\cacaoweb.exe
- %ProgramFiles%\cacaoweb\cacaoweb.exe
- %APPDATA%\cacaoweb\storage.db
Network activity:
Connects to:
- 'lo###.cacaoweb.org':4001
- 'se####.cacaoweb.org':80
- 'up#####.cacaoweb.org':80
- 'localhost':4001
- 'localhost':1040
- 'www.ca###web.org':80
TCP:
HTTP GET requests:
- http://se####.cacaoweb.org/featured?la#####
- http://12#.#.0.1:4001/errors?un########### via localhost
- http://lo###.#acaoweb.org:4001/img/icon-config.png via lo###.cacaoweb.org
- http://lo###.#acaoweb.org:4001/img/icon-dropdown.png via lo###.cacaoweb.org
- http://12#.#.0.1:4001/errors?un########## via localhost
- http://up#####.cacaoweb.org/isloggedin.php
- http://lo###.#acaoweb.org:4001/img/icon-heart.png via lo###.cacaoweb.org
- http://lo###.#acaoweb.org:4001/css/general.css via lo###.cacaoweb.org
- http://lo###.#acaoweb.org:4001/ via lo###.cacaoweb.org
- http://www.ca###web.org/firefoxextension/filelist
- http://lo###.#acaoweb.org:4001/img/logo.png via lo###.cacaoweb.org
- http://lo###.#acaoweb.org:4001/languagestrings.js via lo###.cacaoweb.org
- http://lo###.#acaoweb.org:4001/img/mag-glass.png via lo###.cacaoweb.org
- http://lo###.#acaoweb.org:4001/img/head-bg.gif via lo###.cacaoweb.org
UDP:
- DNS ASK up#####.cacaoweb.org
- DNS ASK se####.cacaoweb.org
- DNS ASK lo###.cacaoweb.org
- DNS ASK www.ca###web.org
- '21#.#51.133.164':11351
- '17#.32.51.4':11357
- '87.##.164.142':11356
- '21#.#51.133.164':21591
- '18#.#65.34.90':11355
- '21#.#51.133.164':11352
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
