Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'navHelper' = '"%APPDATA%\navHelper\navHelper.exe"'
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=localhost:8000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'https=localhost:8000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=localhost:8000;https=localhost:8000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:8000;https=127.0.0.1:8000;'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '1'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<-loopback>'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:8000'
Modifies file system
Creates the following files
- %APPDATA%\navhelper\navhelper.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jjp4auld\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\au3c2mf6\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\v1whxxsk\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\3oauxg3c\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %APPDATA%\microsoft\systemcertificates\my\keys\d344310cdb84bf169e4f60ad6bcb4290fee49ecc
- %APPDATA%\microsoft\systemcertificates\my\certificates\6876efcf79d6f70b502667450032c6a24d758a9a
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\84ef8e32cf3dd22e15e36759d999f0aa_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmp286e.tmp
- %TEMP%\tmp286d.tmp
- %APPDATA%\navhelper\dbgapp.log
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\78c7860e350df0c6e510006ff7358147_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmp13f2.tmp
- %TEMP%\tmp13c2.tmp
- %APPDATA%\microsoft\systemcertificates\my\keys\bb534ba412f62a3d2d996b99bac135e6bfb70336
- %APPDATA%\microsoft\systemcertificates\my\certificates\1264e589ae6cc7842512cd6dc3563b561b306d7d
- %APPDATA%\microsoft\systemcertificates\request\certificates\04782a0fbc4e9f1fe342cd55e2a26912aefb5813
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\31e11aca3166d4520e63926b4d0fdf8b_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\navhelper\dbg.log
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\3oauxg3c\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\v1whxxsk\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\au3c2mf6\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jjp4auld\desktop.ini
Deletes the following files
- %APPDATA%\navhelper\navhelper.exe
- %APPDATA%\microsoft\systemcertificates\request\certificates\04782a0fbc4e9f1fe342cd55e2a26912aefb5813
- %TEMP%\tmp13c2.tmp
- %TEMP%\tmp13f2.tmp
- %TEMP%\tmp286d.tmp
- %TEMP%\tmp286e.tmp
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Adds a root certificate
Creates and executes the following
- '%APPDATA%\navhelper\navhelper.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '%APPDATA%\navHelper\'
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\wininet.dll",DispatchAPICall 1
