Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'Regmonclass', WindowName: ''
- ClassName: 'Filemonclass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\11400c.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qnni8ll7\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\62a988lb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\x22u910j\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ppql54vx\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %TEMP%\39h897859459.exe
- %APPDATA%\bgb\yys\yys_mmq_n.ini
- %APPDATA%\bgb\yys\yys_pc.ini
- %TEMP%\11402b.tmp
- %TEMP%\11a41b.tmp
- %TEMP%\11a43a.tmp
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ppql54vx\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\x22u910j\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\62a988lb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qnni8ll7\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\11400c.tmp
- %TEMP%\11402b.tmp
- %TEMP%\11a41b.tmp
- %TEMP%\11a43a.tmp
Network activity
Connects to
- 'jl##e.com':443
- 'jl##e.com':80
- 'oc##.##ust-provider.cn':80
TCP
HTTP GET requests
- http://www.jl##e.com/gate/bgb/yys.html
- http://oc##.##ust-provider.cn/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCEQCy9qdB6x4%2BMxHuJf67kzf%2B
Other
- 'jl##e.com':443
UDP
- DNS ASK jl##e.com
- DNS ASK oc##.##ust-provider.cn
Miscellaneous
Searches for the following windows
- ClassName: '4823-00000029' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\39h897859459.exe' a1yZt1J+SUm3Zgb8
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get name/value' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c wmic Path Win32_DisplayConfiguration get DeviceName/value' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c wmic COMPUTERSYSTEM get TotalPhysicalMemory/value' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get name/value
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get name/value
- '%WINDIR%\syswow64\cmd.exe' /c wmic Path Win32_DisplayConfiguration get DeviceName/value
- '%WINDIR%\syswow64\wbem\wmic.exe' Path Win32_DisplayConfiguration get DeviceName/value
- '%WINDIR%\syswow64\cmd.exe' /c wmic COMPUTERSYSTEM get TotalPhysicalMemory/value
- '%WINDIR%\syswow64\wbem\wmic.exe' COMPUTERSYSTEM get TotalPhysicalMemory/value
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
