Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'mWGDVHh9i' = '"<SYSTEM32>\ySPfY8.com"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'miN4D5wi' = '"<SYSTEM32>\ySPfY8.com"'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'jPH56yu' = '"<SYSTEM32>\QpZXg1.com"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'rOxBl8Y0' = '"<SYSTEM32>\QpZXg1.com"'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'IroRA' = '"<SYSTEM32>\DNvRPYj.pif"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Wx7Qk' = '"<SYSTEM32>\DNvRPYj.pif"'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'IroRA' = '"<SYSTEM32>\Jv3BxF.bat"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Wx7Qk' = '"<SYSTEM32>\Jv3BxF.bat"'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'jPH56yu' = '"<SYSTEM32>\0FmGb.cmd"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'rOxBl8Y0' = '"<SYSTEM32>\0FmGb.cmd"'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'B5bsDcAG' = '"<SYSTEM32>\QpZXg1.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'miN4D5wi' = '"<SYSTEM32>\QpZXg1.exe"'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '7hvH1' = '"<SYSTEM32>\0FmGb.pif"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'rOxBl8Y0' = '"<SYSTEM32>\0FmGb.pif"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Wx7Qk' = '"<SYSTEM32>\0FmGb.pif"'
Malicious functions
Injects code into
the following user processes:
- ko_hea~1.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FileMonClass', WindowName: ''
- ClassName: 'RegMonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\ko_hea~1.exe
- %APPDATA%\kernel33.dll
- %APPDATA%\1.exe
- %TEMP%\ixp000.tmp\tmp
- %WINDIR%\ko_heavenfireii3.0.96.exe
- %WINDIR%\syswow64\yspfy8.com
- %WINDIR%\syswow64\qpzxg1.com
- %WINDIR%\syswow64\dnvrpyj.pif
- %WINDIR%\syswow64\jv3bxf.bat
- %ALLUSERSPROFILE%\temp:3ea022a8
- %WINDIR%\syswow64\qpzxg1.exe
- %WINDIR%\syswow64\0fmgb.pif
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\yspfy8.com
- %WINDIR%\syswow64\qpzxg1.com
- %WINDIR%\syswow64\dnvrpyj.pif
- %WINDIR%\syswow64\jv3bxf.bat
- %WINDIR%\syswow64\qpzxg1.exe
- %WINDIR%\syswow64\0fmgb.pif
Deletes the following files
- %WINDIR%\ko_heavenfireii3.0.96.exe
- %WINDIR%\syswow64\yspfy8.com
- %TEMP%\ixp000.tmp\ko_hea~1.exe
- %TEMP%\ixp000.tmp\tmp
- %WINDIR%\syswow64\0fmgb.pif
Substitutes the following files
- %WINDIR%\ko_heavenfireii3.0.96.exe
- %WINDIR%\syswow64\yspfy8.com
Network activity
Connects to
- '34.##9.100.209':443
TCP
Other
- '34.##9.100.209':443
Miscellaneous
Searches for the following windows
- ClassName: 'ThunderRT6FormDC' WindowName: 'Shareware Cheater v 3.0'
- ClassName: 'ThunderRT6FormDC' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\ixp000.tmp\ko_hea~1.exe'
- '%APPDATA%\1.exe'
- '%WINDIR%\ko_heavenfireii3.0.96.exe'
- '%WINDIR%\syswow64\yspfy8.com'
- '%WINDIR%\syswow64\qpzxg1.com'
- '%WINDIR%\syswow64\dnvrpyj.pif'
- '%WINDIR%\syswow64\jv3bxf.bat'
- '%WINDIR%\syswow64\qpzxg1.exe'
- '%WINDIR%\syswow64\0fmgb.pif'
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\mswinsck.ocx"
- '%WINDIR%\syswow64\yspfy8.com' ' (with hidden window)
- '%WINDIR%\syswow64\qpzxg1.com' ' (with hidden window)
- '%WINDIR%\syswow64\dnvrpyj.pif' ' (with hidden window)
- '%WINDIR%\syswow64\jv3bxf.bat' ' (with hidden window)
- '%WINDIR%\syswow64\qpzxg1.exe' ' (with hidden window)
- '%WINDIR%\syswow64\0fmgb.pif' ' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\mswinsck.ocx"' (with hidden window)
