Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\H2OFFT] 'ImagePath' = 'system32\DRIVERS\H2OFFT64.sys'
Modifies file system
Creates the following files
- %TEMP%\7zsd02.tmp\ding.wav
- %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\setece4.tmp
- %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\setec28.tmp
- %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\seteb6b.tmp
- %WINDIR%\inf\oem1.pnf
- %WINDIR%\inf\oem0.pnf
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\7zsd02.tmp\isflash.bin
- %TEMP%\7zsd02.tmp\h2offt64.sys
- %TEMP%\7zsd02.tmp\msvcr90.dll
- %TEMP%\7zsd02.tmp\msvcp90.dll
- %TEMP%\7zsd02.tmp\mfc90u.dll
- %TEMP%\7zsd02.tmp\biosimageprocx64.dll
- %TEMP%\7zsd02.tmp\h2offt-wx64.exe
- %TEMP%\7zsd02.tmp\fwupdlcl.exe
- %TEMP%\7zsd02.tmp\flshook.exe
- %TEMP%\7zsd02.tmp\h2offt.inf
- %TEMP%\7zsd02.tmp\h2offt.cat
- %TEMP%\7zsd02.tmp\platform.ini
- %TEMP%\7zsd02.tmp\microsoft.vc90.mfc.manifest
- %TEMP%\7zsd02.tmp\microsoft.vc90.crt.manifest
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %WINDIR%\temp\udd1c8d.tmp
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Deletes the following files
- %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\h2offt.cat
- %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\h2offt.inf
- %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\h2offt64.sys
- %WINDIR%\temp\udd1c8d.tmp
Moves the following files
- from %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\seteb6b.tmp to %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\h2offt64.sys
- from %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\setec28.tmp to %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\h2offt.cat
- from %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\setece4.tmp to %TEMP%\{7d24aa4c-2b28-2c3e-fc1a-d717fc1ad717}\h2offt.inf
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\7zsd02.tmp\h2offt-wx64.exe' -sfx7z "<Current directory>" execApp
