Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- <Full path to file>:{19e1b813-c341-4f48-369f-58b182a0ad6b}
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\98q9cgsp\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\oy2ss9ck\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\54dekoot\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\gbokc3m3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %PROGRAMDATA%\trymedia\stats\8f9b5dcf3838db83ad847f4b538e09d2.xml
- %PROGRAMDATA%\trymedia\data\{9d987d97-71f5-60a5-b427-6e999f729791}
- <Full path to file>:{04c6f9ed-565e-4d4f-1569-561d8dbd3598}
- %PROGRAMDATA%\trymedia\data\{40ea555f-75c3-d876-081c-27a789f840e8}
- <Full path to file>:{1f45e0bc-0107-ebf3-e6ab-3b7b71ad54e8}
- %PROGRAMDATA%\trymedia\data\{886499c6-c1e0-c999-077f-5df8394c2afa}
- <Full path to file>:{285dfaa7-8c02-10bb-5b43-630fe1b50d03}
- %PROGRAMDATA%\trymedia\data\{283d222d-f435-e7e3-b980-6191b3b555ff}
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020072520200726\index.dat
- %PROGRAMDATA%\trymedia\licenses\8f9b5dcf3838db83ad847f4b538e09d2.tmp0
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\gbokc3m3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\54dekoot\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\oy2ss9ck\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\98q9cgsp\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Moves the following files
- from %PROGRAMDATA%\trymedia\licenses\8f9b5dcf3838db83ad847f4b538e09d2.tmp0 to %PROGRAMDATA%\trymedia\licenses\8f9b5dcf3838db83ad847f4b538e09d2.dlcn
Network activity
Connects to
- 'localhost':12071
- 'localhost':17021
TCP
HTTP GET requests
- http://lo#####.gamehouse.com/arcade/sites.html?co################################################################################################################################################...
HTTP POST requests
- http://www.ga###ouse.com/lm/dynamicLicense
UDP
- DNS ASK lo#####.gamehouse.com
- DNS ASK ga###ouse.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
