Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\windows\CurrentVersion\Run] 'QQMin' = '"%CommonProgramFiles%\Microsoft Shared\MSINFO\QQMin.exe"'
Modifies file system
Creates the following files
- %WINDIR%\¹ý¼ì²âçý¶¯³ìðò.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023041120230412\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\down[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\dnserrordiagoff_weboc[1]
- %CommonProgramFiles%\microsoft shared\msinfo\qqmin.bat
- %CommonProgramFiles%\microsoft shared\msinfo\qqmin.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bullet[1]
Sets the 'hidden' attribute to the following files
- %CommonProgramFiles%\microsoft shared\msinfo\qqmin.exe
Deletes the following files
- %WINDIR%\¹ý¼ì²âçý¶¯³ìðò.exe
- %CommonProgramFiles%\microsoft shared\msinfo\qqmin.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]
Substitutes the following files
- %WINDIR%\¹ý¼ì²âçý¶¯³ìðò.exe
Network activity
Connects to
- 'localhost':8010
UDP
- DNS ASK yy.com
- DNS ASK wu###zhe.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\¹ý¼ì²âçý¶¯³ìðò.exe'
- '%CommonProgramFiles%\microsoft shared\msinfo\qqmin.exe'
- '%CommonProgramFiles%\microsoft shared\msinfo\qqmin.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%CommonProgramFiles%\Microsoft Shared\MSINFO\QQMin.bat""' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%CommonProgramFiles%\Microsoft Shared\MSINFO\QQMin.bat""
