Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\7CAFToAVq] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\7CAFToAVq] 'ImagePath' = '%WINDIR%\SysWOW64\7CAFToAVq.sys'
Creates the following services
- '7CAFToAVq' %WINDIR%\SysWOW64\7CAFToAVq.sys
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '<DNS_SERVER>'
- DNS server to '114.114.114.114'
Injects code into
the following user processes:
- b8bf89.exe
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\<File name>.lnk
- <Current directory>\f7b87f\c3eb57c57\jda5ddfc67d\bbca1ok5r.dll
- <Current directory>\f7b87f\h68b4657b5c7\153awsfaw.dll
- <Current directory>\f7b87f\c3eb57c57\edf687d7ec12\4d8doj4ql.exe
- <Current directory>\f7b87f\i338720a3\4e86ok6tp.dll
- <Current directory>\f7b87f\j6b8f7d4f9b5\8499i3pk5.dll
- <Current directory>\f7b87f\c63491720ba1\a8c53qm8v.dll
- <Current directory>\f7b87f\hedcba99\ba8cpk5rm.dll
- <Current directory>\f7b87f\a87de32\1358hcxje.dll
- <Current directory>\f7b87f\h53631a336a\68d7l6sn8.dll
- <Current directory>\f7b87f\c3eb57c57\g3912c52f\52b1rdytf.dll
- <Current directory>\f7b87f\c3eb57c57\fa7712\5ae1zmi4r.dll
- <Current directory>\f7b87f\c3eb57c57\f6a70667b309\afad8vrea.dll
- <Current directory>\f7b87f\c3eb57c57\adb928cb\6c5df1ok6.dll
- <Current directory>\f7b87f\c3eb57c57\e5741ba5700\8484i4rna.dll
- <Current directory>\f7b87f\c3eb57c57\da5dcf21cb4\4e8bg2pl6.dll
- <Current directory>\f7b87f\c3eb57c57\jd196a5\a929upbxs.dll
- <Current directory>\f7b87f\a5f08e30976
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022091820220919\index.dat
- %ProgramFiles(x86)%\google\b8bf89.exe
- %WINDIR%\syswow64\7caftoavq.sys
- <DRIVERS>\27yen1da.sys
Deletes the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022091820220919\index.dat
- <DRIVERS>\etc\hosts
Modifies the following files
Network activity
Connects to
- 'jd##.######-zhangjiakou.aliyuncs.com':80
- '10#.#01.172.229':80
- '22#.#9.68.50':80
- '1.##4.187.4':80
- '58.##3.140.96':80
TCP
HTTP GET requests
- http://jd##.######-zhangjiakou.aliyuncs.com/index.html
UDP
- DNS ASK jd##.######-zhangjiakou.aliyuncs.com
- DNS ASK ba##u.com
- DNS ASK os#.##iyungx.com
- DNS ASK ht##.##crosoftcs.com
- DNS ASK ht###.#ernel-sys.com
- DNS ASK ka####.360kemon.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\google\b8bf89.exe' WfCSd3wffIIwe5IvKYB5dHt8PHsme04=
- '%WINDIR%\syswow64\reg.exe' delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\B8BF8900 /f' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\reg.exe' delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\B8BF8900 /f
