Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Executes the following:
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}" /v IsInstalled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v CurrentLevel /t REG_DWORD /d 69632 /f
- '<SYSTEM32>\cmd.exe' /C xzflyvbs.vbs
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" /v IsInstalled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\net.exe' stop sharedaccess
- '<SYSTEM32>\cmd.exe' /C net stop sharedaccess® ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&taskkill /f /im 360tray.exe&taskkill /f /im QQPCTray.exe&task...
- '<SYSTEM32>\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" /v IsInstalled /t REG_DWORD /d 0 /f® ADD "HKLM\SOFTWARE\Microsoft\Active Setup\I...
- '<SYSTEM32>\net1.exe' stop sharedaccess
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\reg.exe
- <SYSTEM32>\cmd.exe
the following user processes:
- 360tray.exe
Modifies settings of Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '00011000'
Modifies file system:
Creates the following files:
- <Current directory>\gjjk.ini
- <Current directory>\data.txt
- <Current directory>\xzflyvbs.vbs
Deletes the following files:
- <Current directory>\xzflyvbs.vbs
Network activity:
Connects to:
- 'ym####2.f3322.net':8089
- '12##.ip138.com':80
TCP:
HTTP GET requests:
- http://12##.ip138.com/ic.asp
UDP:
- DNS ASK ym####2.f3322.net
- DNS ASK 12##.ip138.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'reg.exe'
- ClassName: '' WindowName: 'cmd.exe'
- ClassName: '' WindowName: 'wscript.exe'
- ClassName: '#32770' WindowName: ''
- ClassName: '' WindowName: 'cscript.exe'
- ClassName: '' WindowName: 'taskkill.exe'
- ClassName: '' WindowName: 'QQPCTray.exe'
- ClassName: '' WindowName: '360sd.exe'
- ClassName: '' WindowName: '360tray.exe'
- ClassName: '' WindowName: 'conhost.exe'
- ClassName: '' WindowName: 'ftp.exe'
