Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2201' = '00000000'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1208' = '00000000'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2201' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\aut6d14.tmp
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3db3d228-a2e9-4581-b400-ce1331c5269e}\content\firefoxoverlay.xul
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3db3d228-a2e9-4581-b400-ce1331c5269e}\components\ltff.dll
- %ProgramFiles(x86)%\easyprediction\2.0\uninstall.exe
- %TEMP%\is-fl8mb.tmp\issproclanguage.ini
- %ProgramFiles(x86)%\autocompletepro\is-de8ec.tmp
- %ProgramFiles(x86)%\autocompletepro\is-7hn9o.tmp
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3db3d228-a2e9-4581-b400-ce1331c5269e}\components\iltff.xpt
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3db3d228-a2e9-4581-b400-ce1331c5269e}\content\overlay.js
- %ProgramFiles(x86)%\autocompletepro\support@predictad.com\is-beq2t.tmp
- %ProgramFiles(x86)%\autocompletepro\support@predictad.com\chrome\content\is-384b1.tmp
- %ProgramFiles(x86)%\autocompletepro\support@predictad.com\chrome\content\is-4qncb.tmp
- %ProgramFiles(x86)%\autocompletepro\support@predictad.com\defaults\preferences\is-4bal5.tmp
- %ProgramFiles(x86)%\autocompletepro\is-7hp9l.tmp
- %ProgramFiles(x86)%\autocompletepro\is-3mmod.tmp
- %ProgramFiles(x86)%\autocompletepro\is-dmnbd.tmp
- %ProgramFiles(x86)%\autocompletepro\support@predictad.com\is-ijai0.tmp
- %ProgramFiles(x86)%\autocompletepro\support@predictad.com\chrome\content\is-02hjk.tmp
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3db3d228-a2e9-4581-b400-ce1331c5269e}\install.rdf
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\{3db3d228-a2e9-4581-b400-ce1331c5269e}\chrome.manifest
- %ProgramFiles(x86)%\easyprediction\2.0\ltie.dll
- %TEMP%\aut6d44.tmp
- %TEMP%\vd.exe
- %TEMP%\aut6d64.tmp
- %TEMP%\acpro.exe
- %TEMP%\aut6f49.tmp
- %TEMP%\shopcompare.exe
- %TEMP%\is-pju0f.tmp\acpro.tmp
- %TEMP%\webfettisetup.exe
- %TEMP%\is-fl8mb.tmp\_isetup\_regdll.tmp
- %TEMP%\is-fl8mb.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-fl8mb.tmp\issproc.dll
- %TEMP%\nsi7c9f.tmp
- %TEMP%\nst7cdf.tmp\system.dll
- %TEMP%\nst7cdf.tmp\iospecial.ini
- %TEMP%\nst7cdf.tmp\installoptions.dll
- %ProgramFiles(x86)%\easyprediction\2.0\ltcore.dll
- %TEMP%\is-fl8mb.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\autocompletepro\unins000.dat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022032820220329\index.dat
Deletes the following files
- %TEMP%\aut6d14.tmp
- %TEMP%\aut6d44.tmp
- %TEMP%\aut6d64.tmp
- %TEMP%\aut6f49.tmp
- %TEMP%\nst7cdf.tmp\installoptions.dll
- %TEMP%\nst7cdf.tmp\iospecial.ini
- %TEMP%\nst7cdf.tmp\system.dll
- %TEMP%\is-fl8mb.tmp\issproc.dll
- %TEMP%\is-fl8mb.tmp\issproclanguage.ini
- %TEMP%\is-fl8mb.tmp\_isetup\_regdll.tmp
- %TEMP%\is-fl8mb.tmp\_isetup\_setup64.tmp
- %TEMP%\is-fl8mb.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-pju0f.tmp\acpro.tmp
Moves the following files
- from %ProgramFiles(x86)%\autocompletepro\is-de8ec.tmp to %ProgramFiles(x86)%\autocompletepro\unins000.exe
- from %ProgramFiles(x86)%\autocompletepro\is-7hn9o.tmp to %ProgramFiles(x86)%\autocompletepro\autocompletepro.dll
- from %ProgramFiles(x86)%\autocompletepro\support@predictad.com\is-beq2t.tmp to %ProgramFiles(x86)%\autocompletepro\support@predictad.com\chrome.manifest
- from %ProgramFiles(x86)%\autocompletepro\support@predictad.com\is-ijai0.tmp to %ProgramFiles(x86)%\autocompletepro\support@predictad.com\install.rdf
- from %ProgramFiles(x86)%\autocompletepro\support@predictad.com\chrome\content\is-02hjk.tmp to %ProgramFiles(x86)%\autocompletepro\support@predictad.com\chrome\content\browseroverlay.xul
- from %ProgramFiles(x86)%\autocompletepro\support@predictad.com\chrome\content\is-384b1.tmp to %ProgramFiles(x86)%\autocompletepro\support@predictad.com\chrome\content\options.js
- from %ProgramFiles(x86)%\autocompletepro\support@predictad.com\chrome\content\is-4qncb.tmp to %ProgramFiles(x86)%\autocompletepro\support@predictad.com\chrome\content\options.xul
- from %ProgramFiles(x86)%\autocompletepro\support@predictad.com\defaults\preferences\is-4bal5.tmp to %ProgramFiles(x86)%\autocompletepro\support@predictad.com\defaults\preferences\predictad.js
- from %ProgramFiles(x86)%\autocompletepro\is-7hp9l.tmp to %ProgramFiles(x86)%\autocompletepro\insttracker.exe
- from %ProgramFiles(x86)%\autocompletepro\is-3mmod.tmp to %ProgramFiles(x86)%\autocompletepro\acremoteupdate.exe
- from %ProgramFiles(x86)%\autocompletepro\is-dmnbd.tmp to %ProgramFiles(x86)%\autocompletepro\taskscheduler.dll
Modifies the following files
Network activity
Connects to
- 're#.###yprediction.com':80
- 'fb##c.com':80
- 'google.com':80
- 'im#.##doparking.com':80
- 'cd##.#redictad.com':80
- 'in#####.autocompletepro.com':80
- 'hu###omains.com':443
TCP
HTTP GET requests
- http://fb##c.com/click/?s=#############################
- http://ww##.fbgdc.com/click/?s=#######################################################################
- http://www.google.com/adsense/domains/caf.js
- http://im#.##doparking.com/templates/bg/arrows.png
- http://ww##.fbgdc.com/favicon.ico
- http://in#####.autocompletepro.com/installHandler/?ac############################
Other
- 'hu###omains.com':443
UDP
- DNS ASK re#.###yprediction.com
- DNS ASK fb##c.com
- DNS ASK ww##.fbgdc.com
- DNS ASK google.com
- DNS ASK im#.##doparking.com
- DNS ASK cd##.#redictad.com
- DNS ASK in#####.autocompletepro.com
- DNS ASK hu###omains.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'Media Center Tray Applet' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: '' WindowName: 'View Available Networks'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Creates and executes the following
- '%TEMP%\vd.exe'
- '%TEMP%\acpro.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\shopcompare.exe'
- '%TEMP%\webfettisetup.exe'
- '%TEMP%\is-pju0f.tmp\acpro.tmp' /SL5="$150222,185455,54272,%TEMP%\AcPro.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles(x86)%\autocompletepro\insttracker.exe' -install -cs:true -si:7999 -ver:1.1 -dir:"%ProgramFiles(x86)%\AutocompletePro"
- '%ProgramFiles(x86)%\autocompletepro\insttracker.exe' -install -cs:true -si:7999 -ver:1.1 -dir:"%ProgramFiles(x86)%\AutocompletePro"' (with hidden window)
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' "http://fb##c.com/click/?s=#############################"' (with hidden window)
Executes the following
- '%WINDIR%\explorer.exe'
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' -Embedding
- '<SYSTEM32>\ctfmon.exe'
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\EasyPrediction\2.0\ltcore.dll", LTFirstDeploy 0
- '%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\EasyPrediction\2.0\ltie.dll" /s
- '%WINDIR%\syswow64\regsvr32.exe' /s AutocompletePro.dll
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' "http://fb##c.com/click/?s=#############################"
