Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%low\temp\tar4bf9.tmp
- %LOCALAPPDATA%low\temp\cab4bf8.tmp
- %LOCALAPPDATA%low\temp\tar1e22.tmp
- %LOCALAPPDATA%low\temp\cab1e21.tmp
- %LOCALAPPDATA%low\temp\tar7a3.tmp
- %LOCALAPPDATA%low\temp\cab792.tmp
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %LOCALAPPDATA%low\temp\tareef2.tmp
- %LOCALAPPDATA%low\temp\cabeef1.tmp
- %APPDATA%\microsoft\windows\ietldcache\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\k5c4fgtb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7ejd6uwu\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\kz6lrk4g\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ho3q5to0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%low\temp\cab5de9.tmp
- %LOCALAPPDATA%low\temp\tar5dea.tmp
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ho3q5to0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\kz6lrk4g\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7ejd6uwu\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\k5c4fgtb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %LOCALAPPDATA%low\temp\cabeef1.tmp
- %LOCALAPPDATA%low\temp\tareef2.tmp
- %LOCALAPPDATA%low\temp\cab792.tmp
- %LOCALAPPDATA%low\temp\tar7a3.tmp
- %LOCALAPPDATA%low\temp\cab1e21.tmp
- %LOCALAPPDATA%low\temp\tar1e22.tmp
- %LOCALAPPDATA%low\temp\cab4bf8.tmp
- %LOCALAPPDATA%low\temp\tar4bf9.tmp
- %LOCALAPPDATA%low\temp\cab5de9.tmp
- %LOCALAPPDATA%low\temp\tar5dea.tmp
Network activity
Connects to
- 'ap#.2ip.ua':443
- 'pk#.goog':80
- 'sd##huz.com':80
- 'sa##fue.com':80
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
- http://sd##huz.com/dl/build2.exe
- http://sa##fue.com/test1/get.php?pi#############################################
- http://sa##fue.com/files/1/build3.exe
Other
- 'ap#.2ip.ua':443
UDP
- DNS ASK ap#.2ip.ua
- DNS ASK pk#.goog
- DNS ASK sd##huz.com
- DNS ASK sa##fue.com
Miscellaneous
Restarts the analyzed sample
