Technical Information
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://dh##.707821.com
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\ie.ico
- <LS_APPDATA>\temp.db
- <LS_APPDATA>\google\chrome\user data\default\bookmarks
- %APPDATA%\temp\temai.png
- %APPDATA%\temp\temai.ico
- %APPDATA%\temp\cpgm.png
- %APPDATA%\temp\cpgm.ico
- %APPDATA%\temp\ybhs.png
- %APPDATA%\temp\ybhs.ico
- %APPDATA%\temp\toutiao.png
- %APPDATA%\temp\toutiao.ico
- %APPDATA%\temp\tmmarket.png
- %APPDATA%\temp\tmmarket.ico
- %APPDATA%\temp\tmall.png
- %APPDATA%\temp\tmall.ico
- %APPDATA%\tempurl.url
- %APPDATA%\temp\ydml.png
- %APPDATA%\temp\jhs.png
- %APPDATA%\temp\jhs.ico
- %APPDATA%\temp\jd.png
- %APPDATA%\temp\jd.ico
- %APPDATA%\temp\aitb.png
- %APPDATA%\temp\aitb.ico
- %APPDATA%\temp\hhts3.png
- %APPDATA%\temp\hhts3.ico
- %APPDATA%\temp\cqfd3.png
- %APPDATA%\temp\cqfd3.ico
- %APPDATA%\temp\wangzdh.png
- %APPDATA%\temp\wangzdh.ico
- %APPDATA%\temp\baidu.png
- %APPDATA%\temp\baidu.ico
- %APPDATA%\temp\ydml.ico
- <LS_APPDATA>\microsoft\windows\history\history.ie5\mshist012019102520191026\index.dat
Deletes the following files
- <LS_APPDATA>\temp.db
- %APPDATA%\tempurl.url
Substitutes the following files
- %APPDATA%\tempurl.url
Network activity
Connects to
- '12###.sogoucdn.com':443
TCP
HTTP GET requests
- http://gg#####.box.720891.com/pinforesults.do?sc#########################################################################################################
- http://po##.dgygpx.com/yxh/navico/temai.png
- http://po##.dgygpx.com/yxh/navico/temai.ico
- http://ym##.#gdebao.com/yxh/navico/cpgm.png
- http://ym##.#gdebao.com/yxh/navico/cpgm.ico
- http://po##.dgygpx.com/yxh/navico/ybhs.png
- http://po##.dgygpx.com/yxh/navico/ybhs.ico
- http://po##.dgygpx.com/yxh/navico/toutiao.png
- http://po##.dgygpx.com/yxh/navico/toutiao.ico
- http://po##.dgygpx.com/yxh/navico/tmmarket.png
- http://po##.dgygpx.com/yxh/navico/tmmarket.ico
- http://po##.dgygpx.com/yxh/navico/tmall.png
- http://po##.dgygpx.com/yxh/navico/tmall.ico
- http://po##.dgygpx.com/yxh/navico/ydml.png
- http://po##.dgygpx.com/yxh/navico/ydml.ico
- http://dh##.707821.com/
- http://po##.dgygpx.com/yxh/navico/jhs.png
- http://po##.dgygpx.com/yxh/navico/jd.png
- http://po##.dgygpx.com/yxh/navico/jd.ico
- http://ym##.#gdebao.com/yxh/navico/aitb.png
- http://ym##.#gdebao.com/yxh/navico/aitb.ico
- http://po##.dgygpx.com/yxh/navico/hhts3.png
- http://po##.dgygpx.com/yxh/navico/hhts3.ico
- http://po##.dgygpx.com/yxh/navico/cqfd3.png
- http://po##.dgygpx.com/yxh/navico/cqfd3.ico
- http://po##.dgygpx.com/yxh/navico/wangzdh.png
- http://po##.dgygpx.com/yxh/navico/wangzdh.ico
- http://po##.dgygpx.com/yxh/navico/baidu.png
- http://po##.dgygpx.com/yxh/navico/baidu.ico
- http://bo##.720891.com/api/tempip.ashx?ac#################################
- http://eo##.dgygpx.com/yxh/img/nwie.ico
- http://po##.dgygpx.com/yxh/navico/jhs.ico
- http://dh##.707821.com/favicon.ico
UDP
- DNS ASK gg#####.box.720891.com
- DNS ASK eo##.dgygpx.com
- DNS ASK ba##u.com
- DNS ASK bo##.720891.com
- DNS ASK po##.dgygpx.com
- DNS ASK ym##.#gdebao.com
- DNS ASK dh##.707821.com
- DNS ASK s1#.#nzz.com
- DNS ASK z8.#nzz.com
- DNS ASK c.##zz.com
- DNS ASK cn##.mmstat.com
- DNS ASK 12#.#ogou.com
- DNS ASK up###.sogoucdn.com
- DNS ASK 12###.sogoucdn.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\attrib.exe' +r "c:\users\public\desktop\google chrome.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "c:\users\public\desktop\mozilla firefox.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%PROGRAMDATA%\microsoft\windows\start menu\programs\mozilla firefox.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\attrib.exe' +r "c:\users\public\desktop\google chrome.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "c:\users\public\desktop\mozilla firefox.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%PROGRAMDATA%\microsoft\windows\start menu\programs\mozilla firefox.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk"
- '%WINDIR%\syswow64\attrib.exe' +r "%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk"
