Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\fsproflt2] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\FSProFilter2] 'Start' = '00000000'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\fsproflt2.exe'
- '%PROGRAM_FILES%\Hide Folders 2012\hf.exe' /s
- '%TEMP%\hf2012_setup.exe' /silent /nocancel /CLOSEAPPLICATIONS /SAVEINF="%temp%\hehe.log"
- '%TEMP%\is-TM51L.tmp\hf2012_setup.tmp' /SL5="$100E2,1754065,54272,%TEMP%\hf2012_setup.exe" /silent /nocancel /CLOSEAPPLICATIONS /SAVEINF="%temp%\hehe.log"
Executes the following:
- '<SYSTEM32>\sc.exe' create fsproflt2 binPath= <SYSTEM32>\fsproflt2.exe DisplayName= "FSPro Filter Service 2" Start= Auto Group= UIGroup
- '<SYSTEM32>\sc.exe' start fsproflt2
- '%WINDIR%\regedit.exe' /s %TEMP%\hf.reg
- '<SYSTEM32>\sc.exe' stop fsproflt2
- '<SYSTEM32>\sc.exe' create FSProFilter2 binPath= System32\Drivers\FSPFltd2.sys Type= filesys start= boot DisplayName= "FSPro File Filter 2" group= "FSFilter Content Screener" depend= FltMgr tag= yes
- '<SYSTEM32>\fltMc.exe' load FSProFilter2
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Hide Folders 2012\skins\is-MQ9IG.tmp
- %PROGRAM_FILES%\Hide Folders 2012\skins\is-HOG9D.tmp
- %PROGRAM_FILES%\Hide Folders 2012\skins\is-SLSM4.tmp
- %PROGRAM_FILES%\Hide Folders 2012\skins\is-NNCAR.tmp
- %PROGRAM_FILES%\Hide Folders 2012\skins\is-7RBNH.tmp
- %PROGRAM_FILES%\Hide Folders 2012\skins\is-R5UU8.tmp
- %PROGRAM_FILES%\Hide Folders 2012\langs\is-PRAPH.tmp
- %PROGRAM_FILES%\Hide Folders 2012\langs\is-PLLM4.tmp
- %PROGRAM_FILES%\Hide Folders 2012\langs\is-QUHUS.tmp
- %PROGRAM_FILES%\Hide Folders 2012\skins\is-E06OS.tmp
- %PROGRAM_FILES%\Hide Folders 2012\langs\is-NDHUR.tmp
- %PROGRAM_FILES%\Hide Folders 2012\sounds\is-4R28J.tmp
- %PROGRAM_FILES%\Hide Folders 2012\unins000.dat
- %PROGRAM_FILES%\Hide Folders 2012\unins000.msg
- %TEMP%\aut3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\release-notes[1].html
- %TEMP%\hf.reg
- %HOMEPATH%\Desktop\Hide Folders 2012.lnk
- %HOMEPATH%\Start Menu\Programs\Hide Folders 2012\Hide Folders 2012 Homepage....lnk
- %PROGRAM_FILES%\Hide Folders 2012\sounds\is-V8MFL.tmp
- %HOMEPATH%\Start Menu\Programs\Hide Folders 2012\Buy Hide Folders 2012 Now!.lnk
- %HOMEPATH%\Start Menu\Programs\Hide Folders 2012\Hide Folders 2012 Help.lnk
- %HOMEPATH%\Start Menu\Programs\Hide Folders 2012\Hide Folders 2012.lnk
- %TEMP%\is-BIUTA.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-BIUTA.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\Hide Folders 2012\is-6T31G.tmp
- %PROGRAM_FILES%\Hide Folders 2012\is-VJADO.tmp
- %PROGRAM_FILES%\Hide Folders 2012\is-BNTQL.tmp
- %TEMP%\is-BIUTA.tmp\_isetup\_RegDLL.tmp
- %TEMP%\lyijabq
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\is-TM51L.tmp\hf2012_setup.tmp
- %TEMP%\hf2012_setup.exe
- %PROGRAM_FILES%\Hide Folders 2012\is-T3ING.tmp
- %PROGRAM_FILES%\Hide Folders 2012\langs\is-1SEG5.tmp
- %PROGRAM_FILES%\Hide Folders 2012\langs\is-FKQNT.tmp
- %PROGRAM_FILES%\Hide Folders 2012\langs\is-Q4GKL.tmp
- %PROGRAM_FILES%\Hide Folders 2012\langs\is-1ND6S.tmp
- %PROGRAM_FILES%\Hide Folders 2012\langs\is-3A03G.tmp
- %PROGRAM_FILES%\Hide Folders 2012\langs\is-UCIJG.tmp
- %PROGRAM_FILES%\Hide Folders 2012\is-M0CF4.tmp
- %PROGRAM_FILES%\Hide Folders 2012\is-BBIRC.tmp
- %PROGRAM_FILES%\Hide Folders 2012\is-PGHJ3.tmp
- <SYSTEM32>\is-VA0ES.tmp
- <DRIVERS>\is-CJCD6.tmp
Deletes the following files:
- %TEMP%\is-TM51L.tmp\hf2012_setup.tmp
- %TEMP%\is-BIUTA.tmp\_isetup\_shfoldr.dll
- %TEMP%\hf2012_setup.exe
- %TEMP%\hf.reg
- %TEMP%\aut3.tmp
- %TEMP%\lyijabq
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\is-BIUTA.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-BIUTA.tmp\_isetup\_iscrypt.dll
Moves the following files:
- from %PROGRAM_FILES%\Hide Folders 2012\langs\is-NDHUR.tmp to %PROGRAM_FILES%\Hide Folders 2012\langs\Spanish.lng
- from %PROGRAM_FILES%\Hide Folders 2012\skins\is-E06OS.tmp to %PROGRAM_FILES%\Hide Folders 2012\skins\Elegant.asz
- from %PROGRAM_FILES%\Hide Folders 2012\skins\is-R5UU8.tmp to %PROGRAM_FILES%\Hide Folders 2012\skins\Office.asz
- from %PROGRAM_FILES%\Hide Folders 2012\langs\is-QUHUS.tmp to %PROGRAM_FILES%\Hide Folders 2012\langs\Russian.lng
- from %PROGRAM_FILES%\Hide Folders 2012\langs\is-1ND6S.tmp to %PROGRAM_FILES%\Hide Folders 2012\langs\Hungarian.lng
- from %PROGRAM_FILES%\Hide Folders 2012\langs\is-PLLM4.tmp to %PROGRAM_FILES%\Hide Folders 2012\langs\Korean.lng
- from %PROGRAM_FILES%\Hide Folders 2012\langs\is-PRAPH.tmp to %PROGRAM_FILES%\Hide Folders 2012\langs\Polish.lng
- from %PROGRAM_FILES%\Hide Folders 2012\skins\is-NNCAR.tmp to %PROGRAM_FILES%\Hide Folders 2012\skins\iOS4.asz
- from %PROGRAM_FILES%\Hide Folders 2012\sounds\is-4R28J.tmp to %PROGRAM_FILES%\Hide Folders 2012\sounds\alarm1p.wav
- from %PROGRAM_FILES%\Hide Folders 2012\sounds\is-V8MFL.tmp to %PROGRAM_FILES%\Hide Folders 2012\sounds\alarm2p.wav
- from %PROGRAM_FILES%\Hide Folders 2012\skins\is-7RBNH.tmp to %PROGRAM_FILES%\Hide Folders 2012\skins\BlackBox.asz
- from %PROGRAM_FILES%\Hide Folders 2012\skins\is-HOG9D.tmp to %PROGRAM_FILES%\Hide Folders 2012\skins\OfficeMetallic.asz
- from %PROGRAM_FILES%\Hide Folders 2012\skins\is-MQ9IG.tmp to %PROGRAM_FILES%\Hide Folders 2012\skins\Sapphire.asz
- from %PROGRAM_FILES%\Hide Folders 2012\skins\is-SLSM4.tmp to %PROGRAM_FILES%\Hide Folders 2012\skins\Neutral.asz
- from %PROGRAM_FILES%\Hide Folders 2012\is-BBIRC.tmp to %PROGRAM_FILES%\Hide Folders 2012\license.txt
- from %PROGRAM_FILES%\Hide Folders 2012\is-M0CF4.tmp to %PROGRAM_FILES%\Hide Folders 2012\Homepage.url
- from %PROGRAM_FILES%\Hide Folders 2012\is-PGHJ3.tmp to %PROGRAM_FILES%\Hide Folders 2012\Buynow.url
- from %PROGRAM_FILES%\Hide Folders 2012\is-T3ING.tmp to %PROGRAM_FILES%\Hide Folders 2012\FSPFlt2.dll
- from %PROGRAM_FILES%\Hide Folders 2012\is-6T31G.tmp to %PROGRAM_FILES%\Hide Folders 2012\unins000.exe
- from %PROGRAM_FILES%\Hide Folders 2012\is-BNTQL.tmp to %PROGRAM_FILES%\Hide Folders 2012\hf.exe
- from %PROGRAM_FILES%\Hide Folders 2012\is-VJADO.tmp to %PROGRAM_FILES%\Hide Folders 2012\hf.chm
- from %PROGRAM_FILES%\Hide Folders 2012\langs\is-1SEG5.tmp to %PROGRAM_FILES%\Hide Folders 2012\langs\English.lng
- from %PROGRAM_FILES%\Hide Folders 2012\langs\is-Q4GKL.tmp to %PROGRAM_FILES%\Hide Folders 2012\langs\Farsi.lng
- from %PROGRAM_FILES%\Hide Folders 2012\langs\is-3A03G.tmp to %PROGRAM_FILES%\Hide Folders 2012\langs\French.lng
- from %PROGRAM_FILES%\Hide Folders 2012\langs\is-FKQNT.tmp to %PROGRAM_FILES%\Hide Folders 2012\langs\Dutch.lng
- from <DRIVERS>\is-CJCD6.tmp to <DRIVERS>\FSPFltd2.sys
- from <SYSTEM32>\is-VA0ES.tmp to <SYSTEM32>\fsproflt2.exe
- from %PROGRAM_FILES%\Hide Folders 2012\langs\is-UCIJG.tmp to %PROGRAM_FILES%\Hide Folders 2012\langs\Arabic.lng
Network activity:
Connects to:
- 'www.fs##o.net':80
- 'localhost':1035
TCP:
HTTP GET requests:
- www.fs##o.net/hide-folders/release-notes.html
UDP:
- DNS ASK www.fs##o.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'THF2012MainForm' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
