Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Hiprotect' = '"%PROGRAM_FILES%\Hiprotect\Hiprotect.exe" /run1'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Hiprotect\Hiprotect.exe' /run2
- '%PROGRAM_FILES%\Hiprotect\HiprotectMtr.exe'
- '%PROGRAM_FILES%\Hiprotect\Hiprotectuck.exe' /run2
- '<Current directory>\hiprotect_livefile.exe' /S
- '%PROGRAM_FILES%\Hiprotect\Hiprotect.exe' /run1
Executes the following:
- '<SYSTEM32>\cmd.exe' /c \DelUS.bat
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system :
Creates the following files:
- %HOMEPATH%\Start Menu\Programs\ЗПАМЗБ·ОЕШЖ®\ЗПАМЗБ·ОЕШЖ®.lnk
- %HOMEPATH%\Start Menu\Programs\ЗПАМЗБ·ОЕШЖ®\ЗПАМЗБ·ОЕШЖ® Б¦°Е.lnk
- %PROGRAM_FILES%\Hiprotect\Uninstall.exe
- %PROGRAM_FILES%\Hiprotect\Hiprotectuck.exe
- %TEMP%\nsm4.tmp\processes_second.dll
- %PROGRAM_FILES%\Hiprotect\partner.ini
- %TEMP%\nsm4.tmp\IEFunctions.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\partner_info[1].ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\update_data[1].ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\version[1].ini
- %TEMP%\nsm4.tmp\DLLWebCount120207.dll
- %TEMP%\nsm4.tmp\SelfDelete.dll
- C:\DelUS.bat
- %PROGRAM_FILES%\Hiprotect\HiprotectMtr.exe
- %TEMP%\nsm4.tmp\ChkClient120207.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\pcroomchk[1].php
- %TEMP%\tempfile.ini
- <Current directory>\hiprotect_livefile.exe
- %TEMP%\nsy2.tmp\SelfDel.dll
- %TEMP%\nsm4.tmp\stack.dll
- %TEMP%\nsm4.tmp\IsVista120207.dll
- %TEMP%\nsm4.tmp\KillProcDLL.dll
- %TEMP%\nsm4.tmp\DLLWaitForKillProgram.dll
- %PROGRAM_FILES%\Hiprotect\Hiprotect.exe
- %TEMP%\nsm4.tmp\Ischeck120207.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\instchk[1].php
- %TEMP%\temppage.ini
Deletes the following files:
- %TEMP%\nsm4.tmp\KillProcDLL.dll
- %TEMP%\nsm4.tmp\IsVista120207.dll
- %TEMP%\nsm4.tmp\Ischeck120207.dll
- %TEMP%\nsm4.tmp\processes_second.dll
- <Current directory>\hiprotect_livefile.exe
- %TEMP%\nsm4.tmp\stack.dll
- %TEMP%\nsm4.tmp\SelfDelete.dll
- %TEMP%\temppage.ini
- %TEMP%\tempfile.ini
- %TEMP%\nsy2.tmp\SelfDel.dll
- %TEMP%\nsm4.tmp\ChkClient120207.dll
- %TEMP%\nsm4.tmp\IEFunctions.dll
- %TEMP%\nsm4.tmp\DLLWebCount120207.dll
- %TEMP%\nsm4.tmp\DLLWaitForKillProgram.dll
Deletes itself.
Network activity:
Connects to:
- 'lo#.##sence.co.kr':80
- 'hi###tect.co.kr':80
- 'localhost':1043
- 'localhost':1035
- 'up####.hiprotect.co.kr':80
- 'www.hi###tect.co.kr':80
TCP:
HTTP GET requests:
- up####.hiprotect.co.kr/version.ini
- up####.hiprotect.co.kr/update_data.ini
- hi###tect.co.krhttp://hiprotect.co.kr/app/app_set.php?pi##########
- hi###tect.co.krhttp://hiprotect.co.kr/app/licensechk.php?sn##############################
- up####.hiprotect.co.kr/partner/partner_info.ini
- up####.hiprotect.co.kr/instchk/instchk.php
- up####.hiprotect.co.kr/instchk/pcroomchk.php
- lo#.##sence.co.kr/logexp.php?ai##################################
- www.hi###tect.co.kr/app/count.php?ki#######################
UDP:
- DNS ASK lo#.##sence.co.kr
- DNS ASK hi###tect.co.kr
- DNS ASK up####.hiprotect.co.kr
- DNS ASK www.hi###tect.co.kr
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysPager' WindowName: '(null)'
- ClassName: 'TrayNotifyWnd' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'NSVCPRTCT' WindowName: '(null)'
- ClassName: 'ToolbarWindow32' WindowName: '(null)'
- ClassName: 'NSVCPRTCTM' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'NSVCPRTCPM' WindowName: '(null)'
- ClassName: 'NSVCPRTCP' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
