Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CdnCtr' = '%ProgramFiles%\CNNIC\Cdn\cdnup.exe'
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}] 'ClsidExtension' = '{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<SYSTEM32>\1013.exe' = '<SYSTEM32>\1013.exe'
Creates or modifies the following files:
- %WINDIR%\Tasks\DM_Install_Program.job
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\aewl] 'ImagePath' = '<DRIVERS>\aewl.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\cdnprot] 'start' = '00000000'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\1101246.exe' = '<SYSTEM32>\1101246.exe:*:Enabled:DM'
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %TEMP%\mjxhz55.exe
- %TEMP%\nsw5.tmp\System.dll
- <SYSTEM32>\drsmartload1186a.exe
- <SYSTEM32>\1013.exe
- <SYSTEM32>\inetsrv\SysOption.bin
- %TEMP%\5066.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\IEHelper\IEHelper_5066.dll
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\loader[1].exe
- C:\drsmartload.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\downurl[1].txt
- <SYSTEM32>\nvwrseng32.dll
- %TEMP%\dm.exe
- %TEMP%\2\idnconvs.dll
- %ProgramFiles%\DeskAdTop\setup.tmp
- %ProgramFiles%\DeskAdTop\Mrup.exe
- %ProgramFiles%\DeskAdTop\deskipn.dll.zgx.tmp
- %ProgramFiles%\DeskAdTop\deskipn.dll.zgx
- %ProgramFiles%\DeskAdTop\Run.dll.zgx.tmp
- %ProgramFiles%\DeskAdTop\Run.dll.zgx
- %ProgramFiles%\DeskAdTop\DeskUn.exe.tmp
- %ProgramFiles%\DeskAdTop\DeskUn.exe
- %ProgramFiles%\DeskAdTop\allverx.dat.tmp
- %ProgramFiles%\DeskAdTop\allverx.dat
- %ProgramFiles%\DeskAdTop\_uninstall
- %ProgramFiles%\DeskAdTop\sinfo.ini
- <SYSTEM32>\lrcsys.exe
- <SYSTEM32>\Plugin.ini
- <SYSTEM32>\HTTPDll.dll
- <SYSTEM32>\YHBO.dll
- %TEMP%\nsw5.tmp\KillProcDLL.dll
- <DRIVERS>\aewl.sys
- %TEMP%\vzy1.tmp
- %TEMP%\2\cdn.dll
- %TEMP%\2\cdnaux.dll
- %TEMP%\2\cdnforie.dll
- %TEMP%\2\cdnins.dll
- %TEMP%\2\cdnprh.dll
- %TEMP%\2\cdnprot.dat
- %TEMP%\2\cdnprot.sys
- %TEMP%\2\cdnunins.exe
- %TEMP%\2\cdnup.exe
- <SYSTEM32>\1101246.exe
- %ProgramFiles%\DeskAdTop\Mrup.exe.tmp
- %TEMP%\2\cdnvers.dat
- %TEMP%\2\src.dat
- %TEMP%\src.tmp
- %ProgramFiles%\CNNIC\Cdn\idnconvs.dll
- %ProgramFiles%\CNNIC\Cdn\cdnvers.dat
- %ProgramFiles%\CNNIC\Cdn\cdnunins.exe
- %ProgramFiles%\CNNIC\Cdn\src.dat
- %ProgramFiles%\CNNIC\Cdn\cdnaux.dll
- %ProgramFiles%\CNNIC\Cdn\cdnup.exe
- %ProgramFiles%\CNNIC\Cdn\cdnforie.dll
- %TEMP%\KooWoLyricBind_rg_lyric_015.exe
- %TEMP%\nsq4.tmp
- %TEMP%\rdcep2.dll
- %TEMP%\2\setup.exe
- %WINDIR%\Temp\ie123456.exe
Deletes the following files:
- %TEMP%\rdcep2.dll
- <DRIVERS>\aewl.sys
- %TEMP%\vzy1.tmp
- %TEMP%\src.tmp
- <SYSTEM32>\nvwrseng32.dll
- %ProgramFiles%\DeskAdTop\Mrup.exe.tmp
- %ProgramFiles%\DeskAdTop\deskipn.dll.zgx.tmp
- %ProgramFiles%\DeskAdTop\Run.dll.zgx.tmp
- %ProgramFiles%\DeskAdTop\DeskUn.exe.tmp
- %ProgramFiles%\DeskAdTop\allverx.dat.tmp
- %ProgramFiles%\DeskAdTop\setup.tmp
Moves the following files:
- from %ProgramFiles%\DeskAdTop\deskipn.dll.zgx to %ProgramFiles%\DeskAdTop\deskipn.dll
- from %ProgramFiles%\DeskAdTop\Run.dll.zgx to %ProgramFiles%\DeskAdTop\Run.dll
Substitutes the following files:
- %TEMP%\src.tmp
Network activity:
Connects to:
- 'localhost':1037
- 'localhost':1039
- 'pr###.#ollarrevenue.com':80
- 'up###.j7y.net':80
- 'ul####3.dudu.com':80
TCP:
HTTP GET requests:
- http://pr###.#ollarrevenue.com/bundle/loader.exe
- http://up###.j7y.net/upcfg/downurl.txt
- http://ul####3.dudu.com/setup/iebar.exe
UDP:
- DNS ASK pr###.#ollarrevenue.com
- DNS ASK up###.j7y.net
- DNS ASK ul####3.dudu.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: '' WindowName: 'CdnHide'
- ClassName: '' WindowName: 'CdnUp'
- ClassName: '' WindowName: 'Chinese Navigation Upgrade'
- ClassName: '' WindowName: 'Chinese Navigation'
Creates and executes the following:
- '%TEMP%\mjxhz55.exe'
- '%TEMP%\2\setup.exe' 00010802
- '%TEMP%\KooWoLyricBind_rg_lyric_015.exe'
- '<SYSTEM32>\drsmartload1186a.exe'
- '<SYSTEM32>\1013.exe'
- '%TEMP%\5066.exe'
- 'C:\drsmartload.exe' 1186
- '%TEMP%\dm.exe'
- '%ProgramFiles%\DeskAdTop\Mrup.exe'
- '<SYSTEM32>\1101246.exe'
- '%WINDIR%\Temp\ie123456.exe' /S
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /u /s "%ProgramFiles%\SearchNet\SNHpr.dll"
- '<SYSTEM32>\regsvr32.exe' /u /s "%ProgramFiles%\Huaci\Huaci\SearchM.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\YHBO.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\HTTPDll.dll"
- '<SYSTEM32>\rundll32.exe' "%ProgramFiles%\DeskAdTop\Run.dll" ,Rundll
- '<SYSTEM32>\regsvr32.exe' "%ProgramFiles%\DeskAdTop\deskipn.dll" -s
