Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\Currentversion\Run] '{D9BCDA41-A605-AD44-B8E2-831792E4A00A}' = '%APPDATA%\Ituke\ohqu.exe'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
the following user processes:
- iexplore.exe
- winmail.exe
Hooks functions
in browsers
- iexplore.exe process, wininet.dll module
- firefox.exe process, crypt32.dll module
- iexplore.exe process, crypt32.dll module
- firefox.exe process, wininet.dll module
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
Modifies file system
Creates the following files
- %APPDATA%\ituke\ohqu.exe
- %LOCALAPPDATA%low\egyl.nyy
- %TEMP%\tmp4fa90c6f.bat
- %TEMP%\ppcrlui_768_2
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%low\egyl.nyy
Deletes itself.
Network activity
Connects to
- 'public-trust.com':80
UDP
- DNS ASK public-trust.com
- '20#.#05.9.206':27038
- '69.#8.209.4':18185
- '20#.#1.250.233':17589
- '18#.#03.46.247':10102
- '19#.#0.51.43':22962
Miscellaneous
Searches for the following windows
- ClassName: 'OutlookExpressHiddenWindow' WindowName: ''
Creates and executes the following
- '%APPDATA%\ituke\ohqu.exe'
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\tmp4fa90c6f.bat"' (with hidden window)
Executes the following
- '%ProgramFiles%\windows mail\winmail.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\tmp4fa90c6f.bat"
