Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'ksiscgwcvfzcne' = '<SYSTEM32>\regsvr32.exe /s "%TEMP%\nsjEA6F.tmp.dll"'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'ksiscgwcvfzcne' = '<SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\rjkacmksiuxi.dll"'
Malicious functions
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
Modifies file system
Creates the following files
- %TEMP%\service.exe
- %TEMP%\setup.exe
- %TEMP%\nsje060.tmp\system.dll
- %TEMP%\nste8b8.tmp\installhelp.dll
- %TEMP%\nsjea6f.tmp.dll
- %WINDIR%\syswow64\qtpjdielrbulqcofd.exe
Deletes the following files
- %TEMP%\nsje060.tmp\system.dll
Moves the following files
- from %TEMP%\nsjea6f.tmp.dll to %WINDIR%\syswow64\rjkacmksiuxi.dll
Network activity
Connects to
- 'google.com':80
UDP
- DNS ASK cr#####eadnetwork.net
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%TEMP%\service.exe'
- '%TEMP%\setup.exe'
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\rjkacmksiuxi.dll"
