Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Wstbra rtpszdno] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Microsoft Uwquss\Gfphfjg.exe'
- '%WINDIR%\addinss1.exe'
Executes the following:
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.km##823.com
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\kmy0823[1]
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\NetSyst61[1].jpg
- %WINDIR%\AppPatch\NetSyst61.dll
- %APPDATA%\E_UIEngine\90afea1eeb37be7a93471c36152ab43a\90afea1eeb37be7a93471c36152ab43a.jpg
- %WINDIR%\addinss1.exe
- %PROGRAM_FILES%\Microsoft Uwquss\Gfphfjg.exe
Network activity:
Connects to:
- 'localhost':1034
- 'dh####.gg.txxsf.com':80
- 'localhost':1030
- 'www.km##823.com':80
TCP:
HTTP GET requests:
- dh####.gg.txxsf.com/ads/NetSyst61.jpg
- www.km##823.com/
UDP:
- DNS ASK dh####.gg.txxsf.com
- DNS ASK www.km##823.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
