Technical Information
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.re###musica.com/amember/login
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://re###.#epromusica.com/es/kasimu-basic
Modifies file system
Creates the following files
- %TEMP%\c759.tmp\c75a.bat
- nul
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020030320200304\index.dat
Deletes the following files
- %TEMP%\c759.tmp\c75a.bat
Network activity
TCP
HTTP GET requests
- http://www.re###musica.com/amember/login
- http://re###.#epromusica.com/templates/gk_technews/css/ie/ie8.css
- http://re###.#epromusica.com/templates/gk_technews/js/ie.js
- http://re###.#epromusica.com/templates/gk_technews/js/respond.js
- http://re###.#epromusica.com/templates/gk_technews/js/selectivizr.js
- http://re###.#epromusica.com/templates/gk_technews/css/normalize.css
- http://re###.#epromusica.com/templates/gk_technews/css/template.css
- http://re###.#epromusica.com/media/jui/js/jquery-noconflict.js
- http://re###.#epromusica.com/media/system/js/html5fallback.js
- http://re###.#epromusica.com/templates/gk_technews/css/mobile.css
- http://re###.#epromusica.com/templates/gk_technews/css/override.css
- http://re###.#epromusica.com/templates/gk_technews/js/scrollreveal.js
- http://re###.#epromusica.com/images/logo.png
- http://re###.#epromusica.com/templates/gk_technews/images/preloaders/default.gif
- http://re###.#epromusica.com/images/kasimu_icon.png
- http://www.re###musica.com/amember/data/public/5c8a791dad754.png
- http://www.re###musica.com/amember/application/default/views/public/img/form-button-bg.png
- http://www.re###musica.com/amember/application/default/views/public/img/top.png
- http://www.re###musica.com/amember/application/default/views/public/img/lang.png
- http://www.re###musica.com/amember/application/default/views/public/img/icons/key.png
- http://re###.#epromusica.com/templates/gk_technews/fonts/font-awesome/fontawesome-webfont.eot?
- http://re###.#epromusica.com/templates/gk_technews/fonts/material-design-icons/MaterialIcons-Regular.eot
- http://re###.#epromusica.com/templates/gk_technews/css/small.tablet.css
- http://re###.#epromusica.com/templates/gk_technews/css/tablet.css
- http://re###.#epromusica.com/templates/gk_technews/css/small.desktop.css
- http://www.re###musica.com/amember/application/default/views/public/css/amember.css?17########
- http://www.re###musica.com/amember/application/default/views/public/css/compat.css?17########
- http://www.re###musica.com/amember/data/public/solid-color/theme.css?21
- http://www.re###musica.com/amember/application/default/views/public/js/jquery/jquery.ui.css?17########
- http://www.re###musica.com/amember/application/default/views/public/js/jquery/jquery.ui.js?17########
- http://www.re###musica.com/amember/application/default/views/public/js/user.js?17########
- http://www.re###musica.com/amember/application/default/views/public/js/upload.js?17########
- http://www.re###musica.com/amember/application/default/views/public/js/magicselect.js?17########
- http://re###.#epromusica.com/es/kasimu-basic
- http://www.re###musica.com/amember/application/default/views/public/css/reset.css?17########
- http://re###.#epromusica.com/es/component/users/?vi########
- http://re###.#epromusica.com/templates/gk_technews/js/modernizr.js
- http://re###.#epromusica.com/templates/gk_technews/css/font-awesome.css
- http://re###.#epromusica.com/templates/gk_technews/css/system/system.css
- http://re###.#epromusica.com/media/jui/js/jquery.min.js
- http://re###.#epromusica.com/media/jui/js/jquery-migrate.min.js
- http://re###.#epromusica.com/media/system/js/core.js
- http://re###.#epromusica.com/templates/gk_technews/js/gk.scripts.js
- http://re###.#epromusica.com/templates/gk_technews/js/gk.menu.js
- http://ht######m.googlecode.com/svn/trunk/html5.js
- http://re###.#epromusica.com/templates/gk_technews/css/k2.css
- http://www.re###musica.com/amember/application/default/views/public/img/icons/users.png
- http://www.re###musica.com/favicon.ico
UDP
- DNS ASK re###musica.com
- DNS ASK cd###.#loudflare.com
- DNS ASK re###.#epromusica.com
- DNS ASK ht######m.googlecode.com
- DNS ASK go#####analytics.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\C759.tmp\C75A.bat <Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\C759.tmp\C75A.bat <Full path to file>"
- '<SYSTEM32>\ping.exe' localhost -n 2
- '<SYSTEM32>\timeout.exe' /t 5
