Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- <Full path to file>:{a96241be-0067-2c7a-4ff0-1516f4e2c79e}
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0mjkpd45\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\vpjpgqg9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\sysna3w9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ou3vg6ej\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %PROGRAMDATA%\trymedia\stats\7bc520f52ab422f41ba1575ab1adc25a.xml
- %PROGRAMDATA%\trymedia\data\{172ac895-955d-fba7-3ec6-227daefd0d74}
- <Full path to file>:{87a1054b-ffb5-e2c9-ac0b-8d13abe8eb51}
- %PROGRAMDATA%\trymedia\data\{7fed0eae-8c8e-0a09-8d7e-20dc9d324f27}
- <Full path to file>:{e79e3760-2a3e-ff3a-cd1e-c66626a0ea92}
- %PROGRAMDATA%\trymedia\data\{a43fc9e0-5b80-b133-479a-ee7673728b2d}
- <Full path to file>:{b911cb26-9235-a830-0fa3-544c56dada52}
- %PROGRAMDATA%\trymedia\data\{9919e1ee-9bac-f978-7b7f-5a32b9336c79}
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020072520200726\index.dat
- %PROGRAMDATA%\trymedia\licenses\7bc520f52ab422f41ba1575ab1adc25a.tmp0
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ou3vg6ej\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\sysna3w9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\vpjpgqg9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0mjkpd45\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Moves the following files
- from %PROGRAMDATA%\trymedia\licenses\7bc520f52ab422f41ba1575ab1adc25a.tmp0 to %PROGRAMDATA%\trymedia\licenses\7bc520f52ab422f41ba1575ab1adc25a.dlcn
Network activity
Connects to
- 'localhost':12071
- 'localhost':17021
TCP
HTTP GET requests
- http://lo#####.gamehouse.com/arcade/sites.html?co################################################################################################################################################...
HTTP POST requests
- http://www.ga###ouse.com/lm/dynamicLicense
UDP
- DNS ASK lo#####.gamehouse.com
- DNS ASK ga###ouse.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
