Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'insertingyuli' = '"%ProgramFiles%\jackrabbit\tremper.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'yuliinserting' = '"%ProgramFiles%\jackrabbit\tremper.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'inserting' = '"%ProgramFiles%\Imitative\flamenco.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'yuliyuli' = '"%ProgramFiles%\Melodramas\flamenco.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'fusty' = '"%ProgramFiles%\Imitative\flamenco.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'hasso' = '"%ProgramFiles%\drexler\hasso.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'insertinginserting' = '"%ProgramFiles%\Melodramas\flamenco.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'denniepresuppose' = '"%ProgramFiles%\jackrabbit\tremper.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'presuppose' = '"%ProgramFiles%\Imitative\flamenco.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dennie' = '"%ProgramFiles%\Imitative\flamenco.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'presupposedennie' = '"%ProgramFiles%\jackrabbit\tremper.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'yuli' = '"%ProgramFiles%\Imitative\flamenco.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'presupposepresuppose' = '"%ProgramFiles%\Melodramas\flamenco.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'denniedennie' = '"%ProgramFiles%\Melodramas\flamenco.exe"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\incrementincrement.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\increment.lnk
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /im chrome.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[11].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[10].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[8].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[12].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[15].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[14].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[13].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[4].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[3].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[2].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[6].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[9].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[7].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[5].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[25].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[24].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[23].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[26].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[29].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[28].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[27].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[18].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[17].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[16].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[19].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[22].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[21].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[20].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\Y20A18A02dO14YA[1].html
- %ProgramFiles%\Imitative\flamenco.dll
- %ProgramFiles%\Imitative\Imitative.exe
- %TEMP%\nsj2.tmp\115221.exe
- %ProgramFiles%\Imitative\flamenco.exe
- %ProgramFiles%\jackrabbit\tremper.exe
- %ProgramFiles%\jackrabbit\tremper.dll
- %ProgramFiles%\jackrabbit\jackrabbit.exe
- %TEMP%\nsj2.tmp\56557.exe
- %TEMP%\nsj2.tmp\46961.exe
- %TEMP%\nsj2.tmp\18538.exe
- %TEMP%\nsj2.tmp\94318.exe
- %TEMP%\nsj2.tmp\Microsoft.Win32.TaskScheduler.dll
- %TEMP%\nsj2.tmp\NMconsumer.exe
- %TEMP%\nsj2.tmp\139712.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\Y20A18A02dO14YA[1].html
- %WINDIR%\cranky.exe
- %ProgramFiles%\drexler\hasso.exe
- %TEMP%\nsyA.tmp\nsExec.dll
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\2-Y20A18A02dO14YA[1].html
- %TEMP%\nsxD.tmp\ShellLink.dll
- %TEMP%\nsyA.tmp\nsB.tmp
- %TEMP%\nsq5.tmp\SimpleFC.dll
- <LS_APPDATA>\tremper.exe
- <LS_APPDATA>\flamenco.exe
- %ProgramFiles%\Melodramas\flamenco.exe
- %TEMP%\nsn7.tmp\AccessControl.dll
- %ProgramFiles%\grenades\grenades.exe
- %ProgramFiles%\Melodramas\tremper.exe
Deletes the following files:
- %TEMP%\nsxD.tmp\ShellLink.dll
- %TEMP%\nsn7.tmp\AccessControl.dll
- %TEMP%\nsq5.tmp\SimpleFC.dll
Network activity:
Connects to:
- 'li###essvell.pw':80
- 'localhost':1045
- 'localhost':1041
- 'localhost':1037
- 'localhost':1038
TCP:
HTTP GET requests:
- http://www.li###essvell.pw/2-Y20A18A02dO14YA.html?14################## via li###essvell.pw
- http://www.li###essvell.pw/Y20A18A02dO14YA.html?14################## via li###essvell.pw
UDP:
- DNS ASK www.li###essvell.pw
Miscellaneous:
Searches for the following windows:
- ClassName: 'Chrome_WidgetWin_0' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%TEMP%\nsj2.tmp\NMconsumer.exe' "%ProgramFiles%\grenades\grenades.exe" "irregularity"
- '%TEMP%\nsj2.tmp\115221.exe'
- '%TEMP%\nsj2.tmp\NMconsumer.exe' "%ProgramFiles%\Melodramas\flamenco.exe" "led_diffuse"
- '%TEMP%\nsj2.tmp\NMconsumer.exe' "%ProgramFiles%\Melodramas\tremper.exe" "phyllis disconcert"
- '%TEMP%\nsj2.tmp\94318.exe'
- '%TEMP%\nsyA.tmp\nsB.tmp' taskkill /im chrome.exe
- '%ProgramFiles%\drexler\hasso.exe'
- '%TEMP%\nsj2.tmp\56557.exe'
- '%ProgramFiles%\Melodramas\tremper.exe'
- '%TEMP%\nsj2.tmp\139712.exe'
- '%ProgramFiles%\Imitative\flamenco.exe'
- '%TEMP%\nsj2.tmp\NMconsumer.exe' "%ProgramFiles%\Imitative\flamenco.exe" "pitney"
- '%TEMP%\nsj2.tmp\NMconsumer.exe' "%ProgramFiles%\jackrabbit\tremper.exe" "aller-eau"
- '%TEMP%\nsj2.tmp\NMconsumer.exe' "<LS_APPDATA>\tremper.exe" "savouring_wicky"
- '%ProgramFiles%\Melodramas\flamenco.exe'
- '%TEMP%\nsj2.tmp\46961.exe'
- '%TEMP%\nsj2.tmp\NMconsumer.exe' "<LS_APPDATA>\flamenco.exe" "backcountry dudman carrick"
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -Embedding
