Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\Software\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\aut1.tmp
- %HOMEPATH%\favorites\links\购物导航.url
- %HOMEPATH%\favorites\携程网.url
- %HOMEPATH%\favorites\链接\携程网.url
- %HOMEPATH%\favorites\links\携程网.url
- %HOMEPATH%\favorites\信用卡申请.url
- %HOMEPATH%\favorites\链接\信用卡申请.url
- %HOMEPATH%\favorites\links\信用卡申请.url
- %HOMEPATH%\favorites\玩手机游戏.url
- %HOMEPATH%\favorites\链接\玩手机游戏.url
- %HOMEPATH%\favorites\链接\网址导航.url
- %HOMEPATH%\favorites\links\玩手机游戏.url
- %HOMEPATH%\favorites\链接\网页游戏.url
- %HOMEPATH%\favorites\links\网页游戏.url
- %HOMEPATH%\favorites\游戏加速.url
- %HOMEPATH%\favorites\链接\游戏加速.url
- %HOMEPATH%\favorites\links\游戏加速.url
- %APPDATA%\microsoft\internet explorer\quick launch\显示桌面.scf
- %APPDATA%\microsoft\internet explorer\quick launch\启动 internet explorer 浏览器.lnk
- %TEMP%\~ihpckpt.inf
- %TEMP%\aut4.tmp
- %HOMEPATH%\favorites\购物导航.url
- %HOMEPATH%\favorites\链接\购物导航.url
- %HOMEPATH%\favorites\links\拼多多.url
- %HOMEPATH%\favorites\链接\拼多多.url
- %HOMEPATH%\favorites\拼多多.url
- %TEMP%\aut2.tmp
- %TEMP%\3872jrbnovk
- %TEMP%\pdxafxf.exe
- %TEMP%\aut3.tmp
- %TEMP%\3928linlduc
- %TEMP%\akxvhuf.exe
- %HOMEPATH%\favorites\百度一下.url
- %HOMEPATH%\favorites\链接\百度一下.url
- %HOMEPATH%\favorites\links\百度一下.url
- %TEMP%\4000uwjesmr
- %HOMEPATH%\favorites\网页游戏.url
- %HOMEPATH%\favorites\网址导航.url
- %HOMEPATH%\favorites\淘宝网.url
- %HOMEPATH%\favorites\链接\淘宝网.url
- %HOMEPATH%\favorites\links\淘宝网.url
- %HOMEPATH%\favorites\京东商城.url
- %HOMEPATH%\favorites\链接\京东商城.url
- %HOMEPATH%\favorites\links\京东商城.url
- %HOMEPATH%\favorites\天猫精选.url
- %HOMEPATH%\favorites\链接\天猫精选.url
- %HOMEPATH%\favorites\links\天猫精选.url
- %TEMP%\3852tppufrn
- %HOMEPATH%\favorites\links\网址导航.url
- %TEMP%\~phwntpz.tmp
Deletes the following files
- %TEMP%\aut1.tmp
- %TEMP%\3852tppufrn
- %TEMP%\aut2.tmp
- %TEMP%\3872jrbnovk
- %TEMP%\aut3.tmp
- <DRIVERS>\etc\hosts
- %TEMP%\3928linlduc
- %TEMP%\~ihpckpt.inf
- %TEMP%\aut4.tmp
- %TEMP%\~phwntpz.tmp
- %TEMP%\akxvhuf.exe
- %TEMP%\pdxafxf.exe
- %TEMP%\4000uwjesmr
Moves the following files
- from %ProgramFiles%\Microsoft Office\office12\grooveshellextensions.dll to %ProgramFiles%\Microsoft Office\office12\~rwrwx.del
Network activity
UDP
- DNS ASK yu#.##gbaicai.com
Miscellaneous
Creates and executes the following
- '%TEMP%\pdxafxf.exe' /HomeRegAccess10
- '%TEMP%\akxvhuf.exe' /HomeRegAccess10
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 %TEMP%\~ihpckpt.inf' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 %TEMP%\~ihpckpt.inf
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
