Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'csrss' = '%WINDIR%\csrss.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'winlogon' = '%WINDIR%\winlogon.exe'
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\csrss.$$a
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\dnserrordiagoff_weboc[1]
- %WINDIR%\winpro.$$a
- %WINDIR%\go.$$a
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]
- %ProgramFiles%\mozilla firefox\browserconfig.$$a
- C:\documents and settings\administrator\local settings\application data\google\chrome\user data\default\preferences.$$a
- C:\documents and settings\admin\local settings\application data\google\chrome\user data\default\preferences.$$a
- %WINDIR%\winlogon.$$a
- %WINDIR%\tv.$$a
- %WINDIR%\rastgele.$$a
- %WINDIR%\mswinsck.$$a
- %WINDIR%\msinet.$$a
- %WINDIR%\hit.$$a
- C:\documents and settings\default user\local settings\application data\google\chrome\user data\default\preferences.$$a
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\down[2]
Moves the following files
- from %WINDIR%\csrss.$$a to %WINDIR%\csrss.exe
- from %WINDIR%\hit.$$a to %WINDIR%\hit.exe
- from %WINDIR%\msinet.$$a to %WINDIR%\msinet.ocx
- from %WINDIR%\mswinsck.$$a to %WINDIR%\mswinsck.ocx
- from %WINDIR%\rastgele.$$a to %WINDIR%\rastgele.txt
- from %WINDIR%\tv.$$a to %WINDIR%\tv.exe
- from %WINDIR%\winlogon.$$a to %WINDIR%\winlogon.exe
- from C:\documents and settings\admin\local settings\application data\google\chrome\user data\default\preferences.$$a to C:\documents and settings\admin\local settings\application data\google\chrome\user data\default\preferences
- from C:\documents and settings\administrator\local settings\application data\google\chrome\user data\default\preferences.$$a to C:\documents and settings\administrator\local settings\application data\google\chrome\user data\default\preferences
- from C:\documents and settings\default user\local settings\application data\google\chrome\user data\default\preferences.$$a to C:\documents and settings\default user\local settings\application data\google\chrome\user data\default\preferences
- from %ProgramFiles%\mozilla firefox\browserconfig.$$a to %ProgramFiles%\mozilla firefox\browserconfig.properties
- from %WINDIR%\go.$$a to %WINDIR%\go.txt
- from %WINDIR%\winpro.$$a to %WINDIR%\winpro.exe
Network activity
TCP
HTTP GET requests
- http://zi###.com:80/say.txt via zi##n.com
UDP
- DNS ASK in###ftware.net
- DNS ASK zi##n.com
Miscellaneous
Searches for the following windows
- ClassName: 'InstItClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\hit.exe'
- '%WINDIR%\csrss.exe'
- '%WINDIR%\winlogon.exe'
- '%WINDIR%\tv.exe'
- '%WINDIR%\winpro.exe'
- '%WINDIR%\csrss.exe' ' (with hidden window)
- '%WINDIR%\winlogon.exe' ' (with hidden window)
