Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\nstf316.tmp\aminsis.dll
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
- %TEMP%\scoped_dir_2140_1678\crx_install\manifest.json
- %TEMP%\scoped_dir_2140_1678\webexpenhancedv1alpha5392.crx
- %TEMP%\9b1.tmp
- %TEMP%\etilqs_grt3rq5bncrjvu8
- %TEMP%\etilqs_cf1y9xisekkuuvq
- %ProgramFiles(x86)%\webexpenhancedv1\webexpenhancedv1alpha5392\uninstall.exe
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions.ini
- %ProgramFiles(x86)%\webexpenhancedv1\webexpenhancedv1alpha5392\ff\chrome\content\icons\default\webexpenhancedv1alpha5392_32.png
- %ProgramFiles(x86)%\webexpenhancedv1\webexpenhancedv1alpha5392\ff\chrome\content\overlay.xul
- %ProgramFiles(x86)%\webexpenhancedv1\webexpenhancedv1alpha5392\ff\chrome\content\ffwebexpenhancedv1alpha5392ffaction.js
- %ProgramFiles(x86)%\webexpenhancedv1\webexpenhancedv1alpha5392\ff\chrome\content\ffwebexpenhancedv1alpha5392.js
- %ProgramFiles(x86)%\webexpenhancedv1\webexpenhancedv1alpha5392\ff\install.rdf
- %ProgramFiles(x86)%\webexpenhancedv1\webexpenhancedv1alpha5392\ff\chrome.manifest
- %ProgramFiles(x86)%\webexpenhancedv1\webexpenhancedv1alpha5392\ch\webexpenhancedv1alpha5392.crx
- %ProgramFiles(x86)%\webexpenhancedv1\webexpenhancedv1alpha5392\ie\webexpenhancedv1alpha5392.dll
- %ProgramFiles(x86)%\webexpenhancedv1\webexpenhancedv1alpha5392\ff\chrome\content\icons\thumbs.db
- %TEMP%\aminsis.txt
Deletes the following files
- %TEMP%\9b1.tmp
- %TEMP%\scoped_dir_2140_1678\crx_install\icon.ico
- %TEMP%\scoped_dir_2140_1678\crx_install\images\webexpenhancedv1alpha5392_128.png
- %TEMP%\scoped_dir_2140_1678\crx_install\images\webexpenhancedv1alpha5392_16.png
- %TEMP%\scoped_dir_2140_1678\crx_install\images\webexpenhancedv1alpha5392_48.png
- %TEMP%\scoped_dir_2140_1678\decoded_images
- %TEMP%\scoped_dir_2140_1678\decoded_message_catalogs
- %TEMP%\scoped_dir_2140_1678\webexpenhancedv1alpha5392.crx
- %TEMP%\nstf316.tmp\aminsis.dll
Substitutes the following files
- %TEMP%\scoped_dir_2140_1678\crx_install\icon.ico
- %TEMP%\scoped_dir_2140_1678\crx_install\images\webexpenhancedv1alpha5392_128.png
- %TEMP%\scoped_dir_2140_1678\crx_install\images\webexpenhancedv1alpha5392_16.png
- %TEMP%\scoped_dir_2140_1678\crx_install\images\webexpenhancedv1alpha5392_48.png
Network activity
Connects to
- 'google.com':443
- 'tr######e.googleapis.com':443
- 'ss#.#static.com':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'google.com':443
- 'tr######e.googleapis.com':443
- 'clients2.google.com':443
- 'ss#.#static.com':443
- 'chrome.google.com':443
UDP
- DNS ASK google.com
- DNS ASK tr######e.googleapis.com
- DNS ASK clients2.google.com
- DNS ASK clients4.google.com
- DNS ASK clients3.google.com
- DNS ASK ss#.#static.com
- DNS ASK pk#.goog
- DNS ASK chrome.google.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\WebexpEnhancedV1\WebexpEnhancedV1alpha5392\ie\WebexpEnhancedV1alpha5392.dll" /s
- '%WINDIR%\syswow64\ctfmon.exe'
