Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\bi40m907j] 'ImagePath' = '%WINDIR%\ihb3x\bi40m907j.sys'
Modifies file system
Creates the following files
- %WINDIR%\h1sx\adhlog.txt
- %WINDIR%\h1sx\ui\sys_dlg_menu.png
- %WINDIR%\h1sx\ui\sys_dlg_min.png
- %WINDIR%\h1sx\ui\sys_dlg_restore.png
- %WINDIR%\h1sx\ui\tabbar_hover.png
- %WINDIR%\h1sx\ui\tabbar_normal.png
- %WINDIR%\h1sx\ui\tabbar_pushed.png
- %WINDIR%\h1sx\ui\toolbar_hover.png
- %WINDIR%\h1sx\ui\toolbar_normal.png
- %WINDIR%\h1sx\ui\sys_dlg_close.png
- %WINDIR%\h1sx\ui\sys_dlg_max.png
- %WINDIR%\h1sx\ui\toolbar_pushed.png
- %WINDIR%\h1sx\module\controlwindow\controlwindow.dll
- %WINDIR%\h1sx\module\controlwindow\controlwindow.dll.__config.ini
- %WINDIR%\h1sx\module\controlwindow\cwapi_32.dll
- %WINDIR%\h1sx\module\controlwindow\glla.exe
- %WINDIR%\h1sx\nononouse.txt
- %WINDIR%\h1sx\module\controlwindow\hkthunk.dll
- %WINDIR%\h1sx\module\controlwindow\hkthunk64.dll
- %WINDIR%\h1sx\module\controlwindow\remote.exe
- %WINDIR%\h1sx\ui\vertical_border.bmp
- %WINDIR%\h1sx\adhres.zip
- %WINDIR%\h1sx\ui\softwaremanager.png
- %WINDIR%\h1sx\ui\skin.xml.bak
- %WINDIR%\h1sx\ui\skin.xml
- %WINDIR%\ihb3x\bi40m907j.sys
- %WINDIR%\h1sx\ui\adhuires.zip
- %WINDIR%\h1sx\ui\antivirus.png
- %WINDIR%\h1sx\ui\bg.jpg
- %WINDIR%\h1sx\ui\button_hover.png
- %WINDIR%\h1sx\ui\button_normal.png
- %WINDIR%\h1sx\ui\button_pushed.png
- %WINDIR%\h1sx\ui\cloud.png
- %WINDIR%\h1sx\ui\commmon.png
- %WINDIR%\h1sx\dv.dat
- %WINDIR%\h1sx\ui\computerexamine.xml
- %WINDIR%\h1sx\ui\firewall.png
- %WINDIR%\h1sx\ui\firewall_ok.png
- %WINDIR%\h1sx\ui\horizontal_border.bmp
- %WINDIR%\h1sx\ui\icon.png
- %WINDIR%\h1sx\ui\navigationbar.bmp
- %WINDIR%\h1sx\ui\networkshield.png
- %WINDIR%\h1sx\ui\preventnumber.png
- %WINDIR%\h1sx\ui\scrollbar.bmp
- %WINDIR%\h1sx\ui\search_bg.png
- %WINDIR%\h1sx\ui\examine_background.bmp
- %WINDIR%\temp\udd1f90.tmp
- %WINDIR%\h1sx\adhdriverlog.txt
Deletes the following files
- %WINDIR%\h1sx\ui\adhuires.zip
- %WINDIR%\h1sx\adhres.zip
- %WINDIR%\ihb3x\bi40m907j.sys
- %WINDIR%\temp\udd1f90.tmp
Network activity
UDP
- DNS ASK 1.###ywl.com
- DNS ASK 3.###ywl.com
- DNS ASK 2.###ywl.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "<Full path to file>"
