Trojan.Click2.64450

Technical Information

Malicious functions:

Creates and executes the following:

'<Current directory>\hzsoft\22011_gw.exe'
'<Current directory>\hzsoft\paopao_59.exe'
'<Current directory>\hzsoft\Baidusd_OnlineSetup_30008.exe'
'<Current directory>\hzsoft\play_2051_144002.exe'
'<Current directory>\hzsoft\KINSTALLERS_69_14598.exe'
'<Current directory>\hzsoft\qqpcmgr_62441_v8.0.9215.228_MINI_Silence.exe'
'<Current directory>\hzsoft\kuping_s_23525.exe'
'<Current directory>\unersqa.exe'
'<Current directory>\hzsoft\down_s_74_110.exe'
'<Current directory>\hzsoft\bird1012_bird1012.exe'
'<Current directory>\hzsoft\setup_2949-14598.exe'
'<Current directory>\hzsoft\KINSTALLERS_69_14598.exe' (downloaded from the Internet)
'<Current directory>\hzsoft\kuping_s_23525.exe' (downloaded from the Internet)
'<Current directory>\hzsoft\qqpcmgr_62441_v8.0.9215.228_MINI_Silence.exe' (downloaded from the Internet)
'<Current directory>\unersqa.exe' (downloaded from the Internet)
'<Current directory>\hzsoft\play_2051_144002.exe' (downloaded from the Internet)
'<Current directory>\hzsoft\down_s_74_110.exe' (downloaded from the Internet)
'<Current directory>\hzsoft\Baidusd_OnlineSetup_30008.exe' (downloaded from the Internet)
'<Current directory>\hzsoft\setup_2949-14598.exe' (downloaded from the Internet)
'<Current directory>\hzsoft\bird1012_bird1012.exe' (downloaded from the Internet)
'<Current directory>\hzsoft\22011_gw.exe' (downloaded from the Internet)
'<Current directory>\hzsoft\paopao_59.exe' (downloaded from the Internet)

Executes the following:

'<SYSTEM32>\cmd.exe' /c <Current directory>\tsghdyi.bat

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

<Current directory>\hzsoft\play_2051_144002.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\kuping_s_23525[1].exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\play_2051_144002[1].exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\22011_gw[1].exe
<Current directory>\hzsoft\22011_gw.exe
<Current directory>\hzsoft\kuping_s_23525.exe
<Current directory>\hzsoft\KINSTALLERS_69_14598.exe
<Current directory>\tsghdyi.bat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\KINSTALLERS_69_14598[1].exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\qqpcmgr_62441_v8.0.9215.228_MINI_Silence[1].exe
<Current directory>\hzsoft\qqpcmgr_62441_v8.0.9215.228_MINI_Silence.exe
<Current directory>\hzsoft\paopao_59.exe
<Current directory>\hzsoft\bird1012_bird1012.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\down_s_74_110[1].exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bird1012_bird1012[1].exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\unersqa[1].exe
<Current directory>\unersqa.exe
<Current directory>\hzsoft\down_s_74_110.exe
<Current directory>\hzsoft\Baidusd_OnlineSetup_30008.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\downx[1].exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Baidusd_OnlineSetup_30008[1].exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\setup_2949-14598[1].exe
<Current directory>\hzsoft\setup_2949-14598.exe