Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WoZhuan' = '%ProgramFiles%\MKMoney\WoZhuan.exe /start'
Creates or modifies the following files:
- %WINDIR%\Tasks\WoZhuanUpdaterVer 2018130.job
Malicious functions:
Modifies settings of Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonZoneCrossing' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonZoneCrossing' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
Modifies file system:
Creates the following files:
- %ProgramFiles%\MKMoney\skin\richmedia\images\shadow_left_ia.png
- %ProgramFiles%\MKMoney\skin\richmedia\images\shadow_right_ia.png
- %ProgramFiles%\MKMoney\skin\richmedia\images\shadow_bottom_ia.png
- %ProgramFiles%\MKMoney\skin\richmedia\images\min.png
- %ProgramFiles%\MKMoney\skin\richmedia\images\mini_logo.png
- %TEMP%\CUR3.tmp
- %TEMP%\CUR4.tmp
- %ProgramFiles%\MKMoney\skin\richmedia\images\title_bg.png
- %ProgramFiles%\MKMoney\skin\richmedia\images\shadow_top_ia.png
- %ProgramFiles%\MKMoney\skin\richmedia\images\tips_logo.png
- %ProgramFiles%\MKMoney\config.ini
- %ProgramFiles%\MKMoney\gdui.dll
- %ProgramFiles%\MKMoney\WoZhuan.exe
- %TEMP%\nsi2.tmp\FindProcDLL.dll
- %ProgramFiles%\MKMoney\Uninstall.exe
- %ProgramFiles%\MKMoney\skin\richmedia\images\close.png
- %ProgramFiles%\MKMoney\skin\richmedia\images\flash_logo.png
- %ProgramFiles%\MKMoney\skin\richmedia\tips.xml
- %ProgramFiles%\MKMoney\skin\richmedia\flash.xml
- %ProgramFiles%\MKMoney\skin\richmedia\minipage.xml
Deletes the following files:
- %TEMP%\CUR4.tmp
- %TEMP%\CUR3.tmp
Network activity:
Connects to:
- 'wo##uan.com':80
- 'ls.##zhuan.com':7100
- 'cp#.#oyoo.com':8800
TCP:
HTTP POST requests:
- http://www.wo##uan.com/PC/Announcement/last via wo##uan.com
UDP:
- DNS ASK www.wo##uan.com
- DNS ASK ls.##zhuan.com
- DNS ASK cp#.#oyoo.com
Miscellaneous:
Creates and executes the following:
- '%ProgramFiles%\MKMoney\WoZhuan.exe' /firstRun
- '%ProgramFiles%\MKMoney\WoZhuan.exe' /report_install
