Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Intel GFX Module' = '%APPDATA%\Microsoft Connect\MicrosoftConnect1.exe'
Modifies file system:
Creates the following files:
- %TEMP%\notice10015102.jpg
- %APPDATA%\Microsoft Connect\MicrosoftConnect1.exe
- %APPDATA%\Microsoft Connect\msimg32.dll
- %TEMP%\585B0B87-2A1D-6337-12525BC1.jpg
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Microsoft Connect\MicrosoftConnect1.exe
- %APPDATA%\Microsoft Connect\msimg32.dll
Network activity:
Connects to:
- 'go###oads.club':80
TCP:
HTTP GET requests:
- http://go###oads.club//0xFBAAAAA0.php?hw##############################
UDP:
- DNS ASK go###oads.club
Miscellaneous:
Searches for the following windows:
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
Creates and executes the following:
- '%APPDATA%\Microsoft Connect\MicrosoftConnect1.exe'
Executes the following:
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\notice10015102.jpg
