Technical Information
Modifies file system
Creates the following files
- C:\system\ccp.zip
- C:\ccp\system\ccproxy.exe
- C:\ccp\system\ccproxy.ini
- C:\ccp\system\lcx.exe
- C:\ccp\system\lefttime.ini
- C:\ccp\system\zlib1.dll
- C:\ccp\system\language\chinesebig5.ini
- C:\ccp\system\ccp.zip
- C:\ccp\system\ccproxy.dll
- C:\ccp\system\language\chinesegb.ini
- C:\ccp\system\web\authinfo-account.htm
- C:\ccp\system\web\authinfo-content.htm
- C:\ccp\system\web\authinfo-site.htm
- C:\ccp\system\web\cn_acclistadmin.htm
- C:\ccp\system\web\cn_acclistuser.htm
- C:\ccp\system\web\en_acclistadmin.htm
- C:\ccp\system\language\english.ini
- C:\ccp\system\web\accinfo.htm
- C:\ccp\system\accinfo.ini
- C:\system\language\english.ini
- C:\system\language\chinesegb.ini
- C:\system\web\authinfo-account.htm
- C:\system\web\authinfo-content.htm
- C:\system\web\authinfo-site.htm
- C:\system\web\cn_acclistadmin.htm
- C:\system\web\cn_acclistuser.htm
- C:\system\web\en_acclistadmin.htm
- C:\system\web\en_acclistuser.htm
- C:\system\web\accinfo.htm
- C:\system\web\proxyadmin.php
- C:\system\ccproxy.dll
- C:\system\ccproxy.exe
- C:\system\ccproxy.ini
- C:\system\lcx.exe
- C:\system\lefttime.ini
- C:\system\zlib1.dll
- C:\system\language\chinesebig5.ini
- C:\system\accinfo.ini
- C:\ccp\system\web\en_acclistuser.htm
- C:\ccp\system\web\proxyadmin.php
Deletes the following files
- C:\system\accinfo.ini
- C:\system\web\en_acclistuser.htm
- C:\system\web\en_acclistadmin.htm
- C:\system\web\cn_acclistuser.htm
- C:\system\web\cn_acclistadmin.htm
- C:\system\web\authinfo-site.htm
- C:\system\web\authinfo-content.htm
- C:\system\web\authinfo-account.htm
- C:\system\web\proxyadmin.php
- C:\system\web\accinfo.htm
- C:\system\lcx.exe
- C:\system\language\english.ini
- C:\system\language\chinesegb.ini
- C:\system\language\chinesebig5.ini
- C:\system\ccproxy.ini
- C:\system\ccproxy.exe
- C:\system\ccproxy.dll
- C:\system\lefttime.ini
- C:\system\zlib1.dll
Network activity
Connects to
- 'localhost':8001
- 'ya##o.com':80
TCP
Other
- 'localhost':49182
- 'localhost':8001
- 'localhost':49183
UDP
- DNS ASK yu####g.vicp.net
- DNS ASK ya##o.com
- 'localhost':53934
- 'localhost':50708
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'CCProxy.exe'
- ClassName: '' WindowName: 'system.exe'
- ClassName: '' WindowName: 'lcx.exe'
- ClassName: 'CCProxy' WindowName: ''
Creates and executes the following
- 'C:\ccp\system\ccproxy.exe'
- 'C:\ccp\system\ccproxy.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "<Full path to file>"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "C:\ccp\system\ccproxy.exe"
