Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run] 'mssn' = '%TEMP%\set.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UUSEE' = '%CommonProgramFiles%\uusee\UUSeeMediaCenter.exe'
Malicious functions:
Creates and executes the following:
- '%TEMP%\Setup.exe'
- '%TEMP%\palyer.exe'
- '%CommonProgramFiles%\bieshawo.enee'
- '%TEMP%\set.exe'
- '%TEMP%\newID7ver0424.exe'
- '%TEMP%\game032.exe'
- '%CommonProgramFiles%\bieshawo.enee' (downloaded from the Internet)
Executes the following:
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' ht#p://ht#p://220.196.59.130/newid7/?s=############################################ 5:34:23 PM&v=C1ADE2E3B0B2AAA0&n=C59AC1BBB5D9B7C6B9D6C8AD
- '<SYSTEM32>\cmd.exe' /c %TEMP%\$$30689.bat
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' ht#p://ht#p://220.196.59.130/newid7/?s=############################################ 5:36:45 PM&v=C1ADE2E3B0B2AAA0&n=C59AC1BBB5D9B7C6B9D6C8AD
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' ht#p://ht#p://220.196.59.130/newid7/?s=############################################ 5:35:29 PM&v=C1ADE2E3B0B2AAA0&n=C59AC1BBB5D9B7C6B9D6C8AD
- '<SYSTEM32>\ntsd.exe' -c q -p 1536
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://21#.#3.81.104/err/?s=############################################ 5:33:01 PM&v=C1ADE2E3B0B2AAA0&n=C59AC1BBB5D9B7C6B9D6C8AD&e=CDBDBCE1BBA0C9E0C9D7B8E999DAAEE4D5E3A49BB1C978F1B8E079EABBC997EA7FCBAADFB1CCA27FC0F3A9E7D0C5C8ADC6ADDB9EBCC6AAE7B5AEBCA078C2E8B7&j=CEB0B09FC4D8C4AD
- '<SYSTEM32>\cmd.exe' /c %CommonProgramFiles%\mint2.bat
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' ht#p://ht#p://220.196.59.130/newid7/?s=############################################ 5:33:14 PM&v=C1ADE2E3B0B2AAA0&n=C59AC1BBB5D9B7C6B9D6C8AD
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
the following user processes:
- 360tray.exe
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\yiun608[1].txt
- %TEMP%\TOFLMPFQTTSG.zbc
- %HOMEPATH%\Desktop\Internet Explorer.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\err[1]
- %TEMP%\CPAAD.MDB
- %CommonProgramFiles%\mint2.bat
- %TEMP%\$$30689.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\oRun[1].exe
- %CommonProgramFiles%\bieshawo.txt
- %TEMP%\game032.exe
- %TEMP%\Setup.exe
- %TEMP%\set.exe
- %TEMP%\newID7ver0424.exe
- %TEMP%\palyer.exe
- %HOMEPATH%\Favorites\iexxЙПНшµјєЅ_НшЦ·µјєЅ_ЙПНшПИЙПiexx.com!.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\count[1].asp
- %CommonProgramFiles%\ppna.txt
Sets the 'hidden' attribute to the following files:
- %TEMP%\Setup.exe
- %TEMP%\palyer.exe
- %TEMP%\game032.exe
- %TEMP%\set.exe
- %TEMP%\newID7ver0424.exe
Deletes the following files:
- %TEMP%\CPAAD.MDB
- %TEMP%\TOFLMPFQTTSG.zbc
Moves the following files:
- from %CommonProgramFiles%\bieshawo.txt to %CommonProgramFiles%\bieshawo.enee
Deletes itself.
Network activity:
Connects to:
- 'www.ch#w.cn':80
- 'localhost':1047
- 'localhost':1046
- 'sc####.sudacc.com':80
- 'localhost':1052
- 'localhost':1051
- 'localhost':1050
- 'localhost':1039
- 'localhost':1038
- 'a.##nw.cn':80
- 'xx#.#aihec.cn':80
- 'ei##.qqjes.com':80
- '21#.#3.81.104':80
- 'localhost':1042
TCP:
HTTP GET requests:
- www.ch#w.cn/CPAAD.MDB
- sc####.sudacc.com/x0606/game032/oRun.exe
- ei##.qqjes.com/page/yiun608.txt
- a.##nw.cn/count/count.asp?sz#######################################################################################################################################################################################################################
- xx#.#aihec.cn/count.asp?id########
UDP:
- DNS ASK www.ch#w.cn
- DNS ASK sc####.sudacc.com
- DNS ASK www.ie##c.cn
- DNS ASK ei##.qqjes.com
- DNS ASK a.##nw.cn
- DNS ASK a1.##ina2z.cn
- DNS ASK xx#.#aihec.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'Button' WindowName: '??????(&N) >'
- ClassName: 'Button' WindowName: '????(&I)'
- ClassName: 'Button' WindowName: '??????????'
- ClassName: 'Button' WindowName: '????(&L)'
- ClassName: 'MS_WINHELP' WindowName: '(null)'
- ClassName: '(null)' WindowName: '???? PPS???????? ????! - Microsoft Internet Explorer'
- ClassName: '(null)' WindowName: '????????-????????????-???????????? - Microsoft Internet Explorer'
- ClassName: 'Button' WindowName: '???????? ????????????'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '#32770' WindowName: ''
- ClassName: '(null)' WindowName: '???????????? ????'
- ClassName: 'IEFrame' WindowName: '(null)'
