Adware.Downware.6031

Technical Information

Malicious functions:

Executes the following:

'<SYSTEM32>\rundll32.exe' dfdts.dll,DfdGetDefaultPolicyAndSMART
'<SYSTEM32>\DllHost.exe' /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Modifies file system :

Creates the following files:

<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\L3kYf[1].jpg
%TEMP%\KXWebBox_3425_RBF.zip
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\1PVp4[1].jpg
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\zp7tnb55.default\prefs-1.js
%PROGRAM_FILES%\Swiffplay\i.html
%TEMP%\qiqibox_1019.zip
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\mxP5j[1].jpg
%TEMP%\-8397_1_meinv.zip
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\UXRxC[1].jpg
%TEMP%\365weatherIns_60.zip
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\7Gj3h[1].jpg
%TEMP%\_kkzm02_s.zip
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\zp7tnb55.default\sessionstore-1.js
%TEMP%\js.log
%TEMP%\sa8SqhjD.part
%APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\ULJORHDO2M91TWEZ0NBH.temp
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\zp7tnb55.default\downloads.sqlite
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\zp7tnb55.default\downloads.sqlite-journal
%TEMP%\nsn770.tmp\System.dll
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\zp7tnb55.default\sessionstore.bak
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\zp7tnb55.default\places.sqlite-wal
%TEMP%\SyETcC4I.css.part
<LS_APPDATA>\Mozilla\Firefox\Profiles\zp7tnb55.default\urlclassifier3.sqlite-journal
%TEMP%\nsn770.tmp\ShellLink.dll
%TEMP%\s2222.zip
%PROGRAM_FILES%\Swiffplay\Intrenet Explorer.ico
%PROGRAM_FILES%\Swiffplay\360дЇААЖч.ico
%TEMP%\nsiCC44.tmp\System.dll
%HOMEPATH%\Desktop\Intrenet Explorer.lnk
%HOMEPATH%\Desktop\360дЇААЖч.lnk
%PROGRAM_FILES%\Swiffplay\_kkzm02_s.exe
%TEMP%\nsc94B1.tmp\Inetc.dll
%TEMP%\nsc94B1.tmp\Base64.dll
%TEMP%\nsc94B1.tmp\System.dll
%TEMP%\nscC562.tmp
%TEMP%\i.rar
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\iplookup[1].php
%TEMP%\nsiCC44.tmp\ZipDLL.dll
%TEMP%\setup_3236.zip
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\VZrNe[1].jpg
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\zWuRk[1].jpg
%TEMP%\setup1256858.zip
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\cXTy0[1].jpg
%PROGRAM_FILES%\Swiffplay\uninst.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Swiffplay\Swiffplay.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Swiffplay\Uninstall.lnk
%TEMP%\nsiCC44.tmp\Inetc.dll
%TEMP%\nsiCC44.tmp\nsProcess.dll
%TEMP%\nsiCC44.tmp\Base64.dll

Deletes the following files:

%TEMP%\nsn770.tmp\ShellLink.dll
%TEMP%\nsiCC44.tmp\ZipDLL.dll
%TEMP%\nsn770.tmp\System.dll
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\zp7tnb55.default\downloads.sqlite-journal
<LS_APPDATA>\Mozilla\Firefox\Profiles\zp7tnb55.default\urlclassifier3.sqlite-journal
%TEMP%\nsiCC44.tmp\Base64.dll
%TEMP%\nscC562.tmp
%TEMP%\nsiCC44.tmp\Inetc.dll
%TEMP%\nsiCC44.tmp\System.dll
%TEMP%\nsiCC44.tmp\nsProcess.dll

Moves the following files:

from %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\ULJORHDO2M91TWEZ0NBH.temp to %APPDATA%\Roaming\Microsoft\Windows\Recent\CustomDestinations\661ab0ff87cd11.customDestinations-ms

Network activity:

Connects to: