Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM firefox.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\v9zip_000\4.ico
- %APPDATA%\microsoft\internet explorer\quick launch\22apple.lnk
- %HOMEPATH%\desktop\22apple.lnk
- %TEMP%\4.ico
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{14323aee-f6b8-4dc8-bce3-e62645830585}.xpi
- %TEMP%\v9zip_000\newtab.xpi
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\newtab.crx
- %TEMP%\v9zip_000\chrome\newtab.crx
- %TEMP%\scoped_dir1708_125\extension.zip
- %TEMP%\v9zip_000\chrome\newtab\popup.js
- %TEMP%\v9zip_000\chrome\newtab\popup.html
- %TEMP%\v9zip_000\chrome\newtab\manifest.json
- %TEMP%\v9zip_000\chrome\newtab\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\novo_price_comparison.crx
- %TEMP%\v9zip_000\firefox\chrome\content\ff-overlay.xul
- %TEMP%\v9zip_000\firefox\chrome\content\ff-overlay.js
- %TEMP%\v9zip_000\chrome\key\newtab.pem
- %TEMP%\v9zip_000\firefox\install.rdf
- %TEMP%\v9zip_000\firefox\chrome.manifest
- %TEMP%\v9zip_000\chrome\novo_price_comparison.crx
- %TEMP%\v9zip_000\sconfig.ini
- %TEMP%\v9zip_000\deskdl.exe
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\22apple.lnk
- %APPDATA%\desk 365\dl_1725237527.exe.tmp
Deletes the following files
- %TEMP%\scoped_dir1708_125\extension.zip
- %TEMP%\v9zip_000\4.ico
- %TEMP%\v9zip_000\chrome\key\newtab.pem
- %TEMP%\v9zip_000\chrome\newtab\background.html
- %TEMP%\v9zip_000\chrome\newtab\manifest.json
- %TEMP%\v9zip_000\chrome\newtab\popup.html
- %TEMP%\v9zip_000\chrome\newtab\popup.js
- %TEMP%\v9zip_000\chrome\newtab.crx
- %TEMP%\v9zip_000\chrome\novo_price_comparison.crx
- %TEMP%\v9zip_000\deskdl.exe
- %TEMP%\v9zip_000\firefox\chrome\content\ff-overlay.js
- %TEMP%\v9zip_000\firefox\chrome\content\ff-overlay.xul
- %TEMP%\v9zip_000\firefox\chrome.manifest
- %TEMP%\v9zip_000\firefox\install.rdf
- %TEMP%\v9zip_000\newtab.xpi
- %TEMP%\v9zip_000\sconfig.ini
Moves the following files
- from %APPDATA%\desk 365\dl_1725237527.exe.tmp to %APPDATA%\desk 365\dl_1725237527.exe
Modifies the following files
- %HOMEPATH%\desktop\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk
- %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Substitutes the following files
- %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data-journal
Network activity
Connects to
- 'go##ayer.cc':80
TCP
HTTP GET requests
- http://www.go##ayer.cc/original/Desk365.exe
UDP
- DNS ASK xa.###gcloud.com
- DNS ASK go##ayer.cc
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_WidgetWin_0' WindowName: ''
- ClassName: 'Chrome_WidgetWin_1' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\v9zip_000\deskdl.exe' -s -ptid:im
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /F /IM firefox.exe
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' --pack-extension=%TEMP%\V9Zip_000\chrome\newtab --pack-extension-key=%TEMP%\V9Zip_000\chrome\key\newtab.pem --no-message-box' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /F /IM firefox.exe' (with hidden window)
- '%TEMP%\v9zip_000\deskdl.exe' -s -ptid:im' (with hidden window)
