Technical Information
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\object\bho_project.dll
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20241008\protected - it is a violation of windows policy to modify\backup.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\domstore\q6intme5\www.msn[1].xml
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20241008\microsoftedgesettingsbackup.txt
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\hp4ihrmi\ntp[1].htm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\racshare\microsoft\crypto\tokenbindingkeys\keys\eea658139b1f4714acd794ff5e5c8408_2db030ff-16d4-42cb-b...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\msimgsiz.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\e2c6cbaf0af08cf203ba74bf0d0ab6d5_6372e0472aff76bb926c97818bc773b9
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\e2c6cbaf0af08cf203ba74bf0d0ab6d5_6372e0472aff76bb926c97818bc773b9
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20241008\schema.txt.~tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20241008\edb00001.log
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20241008\spartan.edb
- %TEMP%\nsiad5d.tmp\registry.dll
- %TEMP%\nsiad5d.tmp\system.dll
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\msimgsiz.dat
Modifies the following files
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.jfm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.edb
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edb.log
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edbtmp.log
Substitutes the following files
- %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
- %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edbtmp.log
Network activity
Connects to
- 'ms#.com':443
- 'fa###heme.com':80
- 'hu###omains.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?39##############
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fc##############
- http://www.fa###heme.com/install_redirect.php
- http://www.fa###heme.com/open_facebook.php
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ce##############
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2e##############
Other
- 'ms#.com':443
- 'hu###omains.com':443
UDP
- DNS ASK fa###heme.com
- DNS ASK iecvlist.microsoft.com
- DNS ASK hu###omains.com
- DNS ASK im######n-com.akamaized.net
- DNS ASK sb.#####cardresearch.com
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Executes the following
- '%WINDIR%\systemapps\microsoft.microsoftedge_8wekyb3d8bbwe\microsoftedge.exe' -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
- '<SYSTEM32>\microsoftedgecp.exe' -ServerName:Windows.Internal.WebRuntime.ContentProcessServer
