Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:7788;https=127.0.0.1:7788;'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<-loopback>'
Modifies file system
Creates the following files
- <Current directory>\fiddlercore4.dll
- %TEMP%\tmp862e.tmp
- %APPDATA%\microsoft\systemcertificates\my\keys\8387f8af6a8d5b8a825d73bba1969770119eab19
- %APPDATA%\microsoft\systemcertificates\my\certificates\698efb7efa8b6e2da8bf918de3d2f2b2014d99b0
- %APPDATA%\microsoft\systemcertificates\request\certificates\96936f1fd9db87a2edc7e6146b59978a89e61411
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\a0665878e24332bcffbdb4728c1dc9d7_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\b4b35915196e05f54295a0143a1fd582_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %TEMP%\tmp7c84.tmp
- %TEMP%\tmp7c64.tmp
- %APPDATA%\microsoft\systemcertificates\my\keys\69cef205291bfa02aea684c2494b6af1b763060b
- %APPDATA%\microsoft\systemcertificates\my\certificates\cadda994c44f36877ef06d3fed4c9df5e50f401b
- %APPDATA%\microsoft\systemcertificates\request\certificates\2f4dd92a0db0423f52e23e7d016df94f8a0bb8f0
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8ed0d7ceb4ac2904a22ecf7da50785b5_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ytjzkzxe\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1zv4bxv0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wezrbfof\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\g4cpnmb7\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- <Current directory>\efd.dll
- <Current directory>\makecert.exe
- %TEMP%\tmp863e.tmp
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\8cc23d3a270fa0da09848d13f9d0a52f_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\g4cpnmb7\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wezrbfof\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1zv4bxv0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ytjzkzxe\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- %APPDATA%\microsoft\systemcertificates\request\certificates\2f4dd92a0db0423f52e23e7d016df94f8a0bb8f0
- %TEMP%\tmp7c64.tmp
- %TEMP%\tmp7c84.tmp
- %APPDATA%\microsoft\systemcertificates\request\certificates\96936f1fd9db87a2edc7e6146b59978a89e61411
- %TEMP%\tmp862e.tmp
- %TEMP%\tmp863e.tmp
Network activity
Connects to
- 'localhost':7788
- 'microsoft.com':80
TCP
HTTP GET requests
- http://12#.#.0.1:7788/proxy.pac
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
UDP
- DNS ASK microsoft.com
Miscellaneous
Modifies value of AutoConfigURL parameter to 'http://127.0.0.1:7788/proxy.pac'
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\wininet.dll",DispatchAPICall 1
