Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\setup.exe'
- '%TEMP%\setup.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\layoc5d2.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\datac610.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\setuc8a0.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\setup.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\yMulc96b.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\setuc70a.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\datac64f.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\ISSec7f4.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\_Setc777.rra
- %TEMP%\{4BE476CE-CFA9-46C0-9243-3C27DCFD0B05}\setup.ini
- %TEMP%\{4BE476CE-CFA9-46C0-9243-3C27DCFD0B05}\_Setup.dll
- %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\setucde5.rra
- %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\Fontcf2d.rra
- %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\dotnceee.rra
- %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\corecea0.rra
- %TEMP%\{4BE476CE-CFA9-46C0-9243-3C27DCFD0B05}\Disk1\ISSetup.dll
- %TEMP%\{4BE476CE-CFA9-46C0-9243-3C27DCFD0B05}\Disk1\data1.hdr
- %TEMP%\{4BE476CE-CFA9-46C0-9243-3C27DCFD0B05}\Disk1\data1.cab
- %TEMP%\{4BE476CE-CFA9-46C0-9243-3C27DCFD0B05}\Disk1\layout.bin
- %TEMP%\{4BE476CE-CFA9-46C0-9243-3C27DCFD0B05}\Disk1\_Setup.dll
- %TEMP%\{4BE476CE-CFA9-46C0-9243-3C27DCFD0B05}\Disk1\setup.ini
- %TEMP%\{4BE476CE-CFA9-46C0-9243-3C27DCFD0B05}\Disk1\setup.exe
- %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\DIFxcf6b.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %TEMP%\setuf3eb.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\defad056.rra
- %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\isrtcfe8.rra
- %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\Stricfaa.rra
- %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\_IsRd0a4.rra
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\download[1].php
- %ALLUSERSPROFILE%\Start Menu\Programs\3D Mullet Fish Free Screensaver\Uninstall MulletFishScr.lnk
- %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\difxd102.rra
Moves the following files:
- from %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\datac610.rra to %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\data1.hdr
- from %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\datac64f.rra to %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\data1.cab
- from %TEMP%\setuf3eb.rra to %TEMP%\setup.exe
- from %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\layoc5d2.rra to %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\layout.bin
- from %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\setuc70a.rra to %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\setup.exe
- from %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\setuc8a0.rra to %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\setup.ini
- from %WINDIR%\yMulc96b.rra to %WINDIR%\yMulletFishScr.exe
- from %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\_Setc777.rra to %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\_Setup.dll
- from %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\ISSec7f4.rra to %PROGRAM_FILES%\InstallShield Installation Information\{633EF9FA-5099-519A-D266-931E026729F6}\ISSetup.dll
- from %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\difxd102.rra to %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\difxapi.dll
- from %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\dotnceee.rra to %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\dotnetinstaller.exe
- from %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\Fontcf2d.rra to %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\FontData.ini
- from %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\setucde5.rra to %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\setup.inx
- from %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\corecea0.rra to %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\corecomp.ini
- from %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\DIFxcf6b.rra to %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\DIFxData.ini
- from %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\defad056.rra to %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\default.pal
- from %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\_IsRd0a4.rra to %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\_IsRes.dll
- from %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\Stricfaa.rra to %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\StringTable-0009-English.ips
- from %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\isrtcfe8.rra to %TEMP%\{1D2ABCE7-256A-4693-915C-D66994AA068A}\{633EF9FA-5099-519A-D266-931E026729F6}\isrt.dll
Network activity:
Connects to:
- 'www.co###13west.com':80
- 'localhost':1037
TCP:
HTTP GET requests:
- www.co###13west.com/download.php?ln######
UDP:
- DNS ASK www.co###13west.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
