Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HandyCache' = 'C:\HandyCache_Repack\Start.bat'
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im ProxHTTPSProxy.exe
- '<SYSTEM32>\taskkill.exe' /f /im HandyCache.exe
Modifies file system:
Creates the following files:
- C:\HandyCache_Repack\Clean.bat
- C:\HandyCache_Repack\cache.lst
- C:\HandyCache_Repack\Clear.gif
- C:\HandyCache_Repack\extensions.lst
- C:\HandyCache_Repack\HandyCache.exe
- C:\HandyCache_Repack\HandyCache.ini
- C:\HandyCache_Repack\libeay32.dll
- C:\HandyCache_Repack\lua5.2.dll
- C:\HandyCache_Repack\noreq.lst
- C:\HandyCache_Repack\onlyfromcache.lst
- C:\HandyCache_Repack\root-public.crt
- C:\HandyCache_Repack\ProxHTTPSProxy\python34.dll
- C:\HandyCache_Repack\black.lst
- C:\HandyCache_Repack\sslcert.dll
- C:\HandyCache_Repack\URLToCache.lst
- C:\HandyCache_Repack\users.lst
- C:\HandyCache_Repack\vcl.dll
- C:\HandyCache_Repack\white.lst
- C:\HandyCache_Repack\HandyCache.ico
- C:\HandyCache_Repack\License.txt
- C:\HandyCache_Repack\Extensions\version.lua
- C:\HandyCache_Repack\Updater\Patch_Downloader.vbs
- C:\HandyCache_Repack\Updater\Updater.bat
- %HOMEPATH%\Start Menu\Programs\HandyCache Repack\Start HandyCache.lnk
- C:\HandyCache_Repack\ssleay32.dll
- C:\HandyCache_Repack\URLF.lst
- C:\HandyCache_Repack\ProxHTTPSProxy\ProxHTTPSProxy.exe
- C:\HandyCache_Repack\ProxHTTPSProxy\MSVCR100.dll
- C:\HandyCache_Repack\ProxHTTPSProxy\config.ini
- C:\HandyCache_Repack\RunAsDate.exe
- C:\HandyCache_Repack\Start.bat
- C:\HandyCache_Repack\Uninstall.bat
- C:\HandyCache_Repack\uninstall.reg
- C:\HandyCache_Repack\Get_File_For_Update.bat
- C:\HandyCache_Repack\Extensions\chunk_handler.lua
- C:\HandyCache_Repack\Extensions\content_downloader.lua
- C:\HandyCache_Repack\Extensions\cors.lua
- C:\HandyCache_Repack\Extensions\header_handler.lua
- C:\HandyCache_Repack\Extensions\License.lua
- C:\HandyCache_Repack\Extensions\monitor_config.lua
- C:\HandyCache_Repack\install.reg
- C:\HandyCache_Repack\Extensions\multi_hc.lua
- C:\HandyCache_Repack\Extensions\rule_editor.hc
- C:\HandyCache_Repack\Extensions\save206.lua
- C:\HandyCache_Repack\Extensions\single_con.lua
- C:\HandyCache_Repack\Extensions\ssl_failover.lua
- C:\HandyCache_Repack\Extensions\webfilter.ini
- C:\HandyCache_Repack\Extensions\webfilter.lua
- C:\HandyCache_Repack\Extensions\whitelist.lua
- C:\HandyCache_Repack\Extensions\x_cleaner.lua
- C:\HandyCache_Repack\Extensions\youtube.lua
- C:\HandyCache_Repack\Language\english.lng
- C:\HandyCache_Repack\ProxHTTPSProxy\CA.crt
- C:\HandyCache_Repack\Extensions\pac.lua
- %HOMEPATH%\Start Menu\Programs\HandyCache Repack\Update HandyCache Configuration.lnk
- %HOMEPATH%\Start Menu\Programs\HandyCache Repack\Uninstall HandyCache.lnk
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""C:\HandyCache_Repack\Start.bat" "
- '%WINDIR%\regedit.exe' /s C:\HandyCache_Repack\Install.reg
