Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\e_n30005\krnln.fnr
- %TEMP%\e_n30005\htmlview.fne
- %TEMP%\e_n30005\shell.fne
- %TEMP%\e_n30005\internet.fne
- %TEMP%\e_n30005\eapi.fne
- %TEMP%\e_n30005\spec.fne
- %TEMP%\e_n30005\ethread.fne
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021062420210625\index.dat
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\dd[1].xml
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\1ilya49m\www.yy[1].xml
Modifies the following files
Network activity
Connects to
- 'dd.ma':80
- 'hm.##idu.com':80
- 'hm.##idu.com':443
- 'microsoft.com':80
- 'ha#.#50gj.com':80
- 'yy.com':80
- 'yy.com':443
- 'ba###.aliyun.com':80
- 'al##un.com':443
- 'oc##.dcocsp.cn':80
- 'we#.##static.com':443
- 'yy###.yystatic.com':443
- 'we#.##static.com':80
- 'al###.alicdn.com':443
TCP
HTTP GET requests
- http://dd.ma/
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHv1Dj%2BciPJEWH5JNtwL5Y07mRqwQUxBF%2BiECGwkG%2FZfMa4bRTQKOr7H0CEAazeQNdMUy43GisOeZFKho%3D
- http://dd.ma/common/alert.png
- http://dd.ma/common/btn_sign-in.png
- http://dd.ma/common/lock.jpg
- http://dd.ma/common/three.png
- http://dd.ma/common/two.png
- http://dd.ma/common/one.png
- http://dd.ma/version2.png
- http://dd.ma/common/nav_sign.png
- http://dd.ma/common/header_bg_home.jpg
- http://dd.ma/common/icon_unique.jpg
- http://dd.ma/common/icon_publish.png
- http://dd.ma/common/features.png
- http://dd.ma/common/form_share.png
- http://dd.ma/common/form_types.png
- http://dd.ma/common/form.png
- http://hm.##idu.com/h.js?c8##############################
- http://dd.ma/common/Logo.png
- http://dd.ma/login_tile.gif
- http://dd.ma/common/jquery_002.js
- http://dd.ma/common/jquery_003.js
- http://dd.ma/common/menu.js
- http://dd.ma/common/jquery.js
- http://dd.ma/common/print.css
- http://dd.ma/common/mainfont.css
- http://dd.ma/common/reset.css
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAGgn4WFmB1OXBcN0AZmOac%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAU42%2FBN%2BsTtgd17xWAmjnA%3D
Other
- 'hm.##idu.com':443
- 'yy.com':443
- 'al##un.com':443
- 'oc##.dcocsp.cn':443
- 'cn.##iyun.com':443
- 'at.##icdn.com':443
UDP
- DNS ASK on#.pw
- DNS ASK g.###cdn.com
- DNS ASK im###.yy.com
- DNS ASK yy###.yystatic.com
- DNS ASK we#.##static.com
- DNS ASK oc##.dcocsp.cn
- DNS ASK cn.##iyun.com
- DNS ASK at.##icdn.com
- DNS ASK al##un.com
- DNS ASK yy.com
- DNS ASK ha#.#50gj.com
- DNS ASK microsoft.com
- DNS ASK js.##m.cnzz.net
- DNS ASK hm.##idu.com
- DNS ASK dd.ma
- DNS ASK ba###.aliyun.com
- DNS ASK al###.alicdn.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\syswow64\cmd.exe"
