Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '{D9033079-2B85-6FD1-F761-C1CBA6419D5A}' = '%TEMP%\lhrpelwx.exe'
Malicious functions:
Creates and executes the following:
- '%TEMP%\lhrpelwx.exe'
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system :
Creates the following files:
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\XUL.mfl
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions-1.ini
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite-journal
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite-wal
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\urlclassifier3.sqlite-journal
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Y9kV99DLLCxX8nQRYPP3Le1fvleIGey7x8XGO07L1UaW3qrzc76UVoLdTMJtBzymp5Ah%2fvtuMWgxothQs3LrsY47uY01GzeD61TOiJ6ReuswpwRcdI8l879Y8ZPca0jHi%2f24MGHA%2fjF3%2bDB5Je[1]
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs-1.js
- %TEMP%\data.dat
- %TEMP%\setup.dat
- %TEMP%\lhrpelwx.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{E1476F58-0D13-9ECF-E89D-E42DE08FAE6C}\components\VirtualStorageObject.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{E1476F58-0D13-9ECF-E89D-E42DE08FAE6C}\install.rdf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{E1476F58-0D13-9ECF-E89D-E42DE08FAE6C}\chrome.manifest
Deletes the following files:
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\urlclassifier3.sqlite-journal
Network activity:
Connects to:
- 'localhost':1040
- 'fx####s.mozilla.com':80
- 'se###h-page.net':80
- 'localhost':1036
- 'localhost':1038
- '21#.#24.126.66':80
TCP:
HTTP GET requests:
- se###h-page.net/u3574798080/31C8Tpx/L3Zjig3tFVR3uB9x0JuH7rV4oSHECsypQ3wiUCyBhMhZr3+KXYdB7OZOqZM+NTfLttGC+ElbP0GL29BfJvwRqgF2oa9veMuLP48HTtHzaolAYnu1AQIefIcgecLgZfU%3D?1
- fx####s.mozilla.com/en-US/firefox/headlines.xml
UDP:
- DNS ASK se###h-page.net
- DNS ASK fx####s.mozilla.com
Miscellaneous:
Searches for the following windows:
- ClassName: '{CE802B5D-3C90-4BC5-937D-CB2E8DDC5B9D}' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'FirefoxMessageWindow' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
