Technical Information
Malicious functions
Injects code into
the following user processes:
- chrome.exe
Modifies file system
Creates the following files
- <Current directory>\lnktodesktop.vbs
- %TEMP%\lorca014918639\default\cache\index
- %TEMP%\lorca014918639\default\cache\data_0
- %TEMP%\lorca014918639\default\cache\data_1
- %TEMP%\lorca014918639\default\cache\data_2
- %TEMP%\lorca014918639\default\cache\data_3
- %TEMP%\lorca014918639\default\gpucache\index
- %TEMP%\lorca014918639\default\gpucache\data_0
- %TEMP%\lorca014918639\default\gpucache\data_1
- %TEMP%\lorca014918639\default\gpucache\data_2
- %TEMP%\lorca014918639\default\gpucache\data_3
- %TEMP%\lorca014918639\f204.tmp
- %TEMP%\lorca014918639\default\f205.tmp
- %TEMP%\lorca014918639\default\f2e1.tmp
- %TEMP%\lorca014918639\default\extension state\manifest-000001
- %TEMP%\lorca014918639\default\extension state\000001.dbtmp
- %TEMP%\lorca014918639\default\extension state\log
- %TEMP%\lorca014918639\default\extension state\000003.log
- %TEMP%\lorca014918639\default\19bf.tmp
- %TEMP%\lorca014918639\229a.tmp
- %TEMP%\lorca014918639\default\cache\f_000001
- %TEMP%\lorca014918639\default\4f7d.tmp
- %TEMP%\lorca014918639\6160.tmp
- %TEMP%\lorca014918639\default\web applications\aidesoft.gabia.io\http_80\7aec.tmp
- %TEMP%\lorca014918639\default\web applications\aidesoft.gabia.io\http_80\미디어에이드.ico.md5
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\lorca014918639\default\cookies
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\etilqs_gj5s9jbe5hqf8jp
- %TEMP%\lorca014918639\default\visited links
- %HOMEPATH%\desktop\mediaaide.lnk
- %TEMP%\lorca014918639\default\extension rules\manifest-000001
- %TEMP%\lorca014918639\default\extension rules\000001.dbtmp
- %TEMP%\lorca014918639\default\extension rules\log
- %TEMP%\lorca014918639\default\history-journal
- %TEMP%\etilqs_lo0mkklbeand5oy
- %TEMP%\lorca014918639\default\web data-journal
- %TEMP%\etilqs_9xw6cx7alalmijo
- %TEMP%\lorca014918639\default\web data
- %TEMP%\lorca014918639\default\history
- %TEMP%\lorca014918639\default\top sites-journal
- %TEMP%\etilqs_h7fg51enkyifdcz
- %TEMP%\lorca014918639\default\top sites
- %TEMP%\lorca014918639\default\favicons-journal
- %TEMP%\etilqs_vkiprbbsplvnewg
- %TEMP%\lorca014918639\default\favicons
- %TEMP%\lorca014918639\default\cb60.tmp
- %TEMP%\lorca014918639\devtoolsactiveport
- %TEMP%\lorca014918639\default\shortcuts-journal
- %TEMP%\lorca014918639\default\shortcuts
- %TEMP%\lorca014918639\default\network action predictor-journal
- %TEMP%\lorca014918639\default\network action predictor
- %TEMP%\lorca014918639\default\login data-journal
- %TEMP%\etilqs_wxaqa2c6eluo0ax
- %TEMP%\lorca014918639\default\login data
- %TEMP%\lorca014918639\default\cookies-journal
- %TEMP%\lorca014918639\default\readme
Deletes the following files
- <Current directory>\lnktodesktop.vbs
- %TEMP%\lorca014918639\default\cb60.tmp
- %TEMP%\lorca014918639\default\secure preferences~rf1119af.tmp
- %TEMP%\lorca014918639\local state~rf1122c7.tmp
- %TEMP%\lorca014918639\default\secure preferences~rf114f75.tmp
- %TEMP%\lorca014918639\local state~rf1161a5.tmp
Moves the following files
- from %TEMP%\lorca014918639\default\extension rules\000001.dbtmp to %TEMP%\lorca014918639\default\extension rules\current
- from %TEMP%\lorca014918639\f204.tmp to %TEMP%\lorca014918639\local state
- from %TEMP%\lorca014918639\default\f205.tmp to %TEMP%\lorca014918639\default\secure preferences
- from %TEMP%\lorca014918639\default\f2e1.tmp to %TEMP%\lorca014918639\default\preferences
- from %TEMP%\lorca014918639\default\extension state\000001.dbtmp to %TEMP%\lorca014918639\default\extension state\current
- from %TEMP%\lorca014918639\default\19bf.tmp to %TEMP%\lorca014918639\default\secure preferences
- from %TEMP%\lorca014918639\default\secure preferences to %TEMP%\lorca014918639\default\secure preferences~rf1119af.tmp
- from %TEMP%\lorca014918639\229a.tmp to %TEMP%\lorca014918639\local state
- from %TEMP%\lorca014918639\local state to %TEMP%\lorca014918639\local state~rf1122c7.tmp
- from %TEMP%\lorca014918639\default\4f7d.tmp to %TEMP%\lorca014918639\default\secure preferences
- from %TEMP%\lorca014918639\default\secure preferences to %TEMP%\lorca014918639\default\secure preferences~rf114f75.tmp
- from %TEMP%\lorca014918639\6160.tmp to %TEMP%\lorca014918639\local state
- from %TEMP%\lorca014918639\local state to %TEMP%\lorca014918639\local state~rf1161a5.tmp
- from %TEMP%\lorca014918639\default\web applications\aidesoft.gabia.io\http_80\7aec.tmp to %TEMP%\lorca014918639\default\web applications\aidesoft.gabia.io\http_80\미디어에이드.ico
Substitutes the following files
- %TEMP%\lorca014918639\default\secure preferences
- %TEMP%\lorca014918639\local state
Network activity
TCP
HTTP GET requests
- http://ai####ft.gabia.io/benner3.html
- http://ai####ft.gabia.io/ott/Netflix.jpg
- http://ai####ft.gabia.io/ott/Wavve.jpg
- http://ai####ft.gabia.io/ott/TVing.jpg
- http://ai####ft.gabia.io/ott/Watcha.jpg
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://ai####ft.gabia.io/favicon.ico
- http://er####.gabia.net/404.html
UDP
- DNS ASK google.com
- DNS ASK ai####ft.gabia.io
- DNS ASK st######h.bootstrapcdn.com
- DNS ASK co##.jquery.com
- DNS ASK ta##.#lickmon.co.kr
- DNS ASK cd###.#loudflare.com
- DNS ASK st###.#lickmon.co.kr
- DNS ASK ad#####.clickmon.co.kr
- DNS ASK microsoft.com
- DNS ASK er####.gabia.net
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%TEMP%\lorca014918639'
Executes the following
- '<SYSTEM32>\wscript.exe' lnkToDesktop.vbs
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-default-apps...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="1868.0.153348396\1963204444" --disable-breakpad --user-data-dir="%TEMP%\lorca014918639" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendo...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --disable-breakpad --enable-deferred-image-decoding --lang=en-US --user-data-dir="%TEMP%\lorca014918639" --disable-client-side-phishing-detection --enable-offline-auto-reload --...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --disable-breakpad --enable-deferred-image-decoding --lang=en-US --user-data-dir="%TEMP%\lorca014918639" --extension-process --enable-webrtc-hw-h264-encoding --disable-client-si...
