Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\WindowsXP-KB968930-x86-ENG.exe' /quiet /norestart
- '%TEMP%\WindowsXP-KB968930-x86-ENG.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\dllhost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\dllhost.exe
Modifies file system :
Creates the following files:
- %TEMP%\WindowsXP-KB968930-x86-ENG.exe
Deletes the following files:
- %TEMP%\WindowsXP-KB968930-x86-ENG.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\WindowsXP-KB968930-x86-ENG[1].exe
Network activity:
Connects to:
- 'f0##80.com':80
- '31.##4.192.80':80
- '19#.#.241.84':80
- 'cd##5c.com':80
- 'localhost':1042
- '20#.#6.232.182':80
TCP:
HTTP GET requests:
- 20#.#6.232.182/download/E/C/E/ECE99583-2003-455D-B681-68DB610B44A4/WindowsXP-KB968930-x86-ENG.exe
HTTP POST requests:
- 31.##4.192.80/q
- 19#.#.241.84/q
- cd##5c.com/q
- f0##80.com/q
UDP:
- DNS ASK f0##80.com
- DNS ASK do#####d.microsoft.com
- DNS ASK cd##5c.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
