Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{33e730b4-a400-4924-a8e7-4752954403e7}' = '"<LS_APPDATA>\Package Cache\{33e730b4-a400-4924-a8e7-4752954403e7}\SelfExtract.exe" /burn.runo...
Malicious functions:
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '18.216.123.98'
Creates and executes the following:
- '%TEMP%\{13BF269E-71DC-47B1-AABE-5CE0F782EF8C}\.cr\wb_ni_23_139_c.exe' -burn.clean.room="%APPDATA%\wb_ni_23_139_c.exe" -burn.filehandle.attached=348 -burn.filehandle.self=344 -norestart -repair -s
- '%TEMP%\is-TS0O9.tmp\temp.tmp' /SL5="$100EE,363326,56832,%APPDATA%\temp.exe" /VERYSILENT
- '%APPDATA%\wb_ni_23_139_c.exe' -norestart -repair -s
- '%APPDATA%\temp.exe' /VERYSILENT
Executes the following:
- '<SYSTEM32>\netsh.exe' interface ipv4 add dnsserver "Ethernet" address=18.216.123.98
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding A80EF4A4439663B642038EDB0F039FAD
- '<SYSTEM32>\cmd.exe' /C netsh interface ip set dns name="Local Area Connection" static 18.216.123.98
- '<SYSTEM32>\cmd.exe' /C netsh interface ipv4 add dnsserver "Ethernet" address=18.216.123.98
- '<SYSTEM32>\netsh.exe' interface ip set dns name="Local Area Connection" static 18.216.123.98
Modifies file system:
Creates the following files:
- %TEMP%\{3DF6B228-BFB1-46DC-B57D-222E899387BC}\.be\SelfExtract.exe
- <LS_APPDATA>\Package Cache\{33e730b4-a400-4924-a8e7-4752954403e7}\SelfExtract.exe
- %TEMP%\is-ASUJM.tmp\_isetup\_shfoldr.dll
- %TEMP%\{3DF6B228-BFB1-46DC-B57D-222E899387BC}\.ba\BootstrapperApplicationData.xml
- <LS_APPDATA>\Package Cache\{33e730b4-a400-4924-a8e7-4752954403e7}\state.rsm
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI2.tmp
- %TEMP%\{3DF6B228-BFB1-46DC-B57D-222E899387BC}\WeatherBuddy
- %WINDIR%\Installer\23e86.msi
- %TEMP%\{3DF6B228-BFB1-46DC-B57D-222E899387BC}\.ba\license.rtf
- %TEMP%\{13BF269E-71DC-47B1-AABE-5CE0F782EF8C}\.cr\wb_ni_23_139_c.exe
- <LS_APPDATA>\flashpluginv_2.1.exe
- %APPDATA%\wb_ni_23_139_c.exe
- %APPDATA%\temp.exe
- %TEMP%\is-TS0O9.tmp\temp.tmp
- %TEMP%\{3DF6B228-BFB1-46DC-B57D-222E899387BC}\.ba\thm.wxl
- %TEMP%\{3DF6B228-BFB1-46DC-B57D-222E899387BC}\.ba\logo.png
- %TEMP%\{3DF6B228-BFB1-46DC-B57D-222E899387BC}\.ba\wixstdba.dll
- %TEMP%\{3DF6B228-BFB1-46DC-B57D-222E899387BC}\.ba\thm.xml
Deletes the following files:
- %WINDIR%\Installer\MSI1.tmp
- %APPDATA%\temp.exe
Moves the following files:
- from <LS_APPDATA>\Package Cache\.unverified\WeatherBuddy to <LS_APPDATA>\Package Cache\{33BC2D7A-2CFE-40C7-9B99-117886D9E0E4}v1.0.23\WeatherBuddy_ni_v23.msi
- from %TEMP%\{3DF6B228-BFB1-46DC-B57D-222E899387BC}\WeatherBuddy to <LS_APPDATA>\Package Cache\.unverified\WeatherBuddy
Network activity:
Connects to:
- 'www.my###search.com':80
- 'of##px.net':443
TCP:
HTTP GET requests:
- http://www.my###search.com/src_srv_api/reportattempt.php?tp############
UDP:
- DNS ASK www.my###search.com
- DNS ASK of##px.net
