Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bellvillebellville' = '"%ProgramFiles%\Innkeeper\ran.exe" SH'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'rone' = '"%ProgramFiles%\Ayios\ran.exe" SH'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ronerone' = '"%ProgramFiles%\Innkeeper\ran.exe" SH'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'cynthia' = '"%ProgramFiles%\Ayios\ran.exe" SH'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'fulminant' = '"%ProgramFiles%\wollstonecraft\fulminant.exe" SH'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lenz' = '"%ProgramFiles%\Ayios\ran.exe" SH'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'shoval' = '"%ProgramFiles%\Ayios\ran.exe" SH'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'shovalshoval' = '"%ProgramFiles%\Innkeeper\ran.exe" SH'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bellville' = '"%ProgramFiles%\Ayios\ran.exe" SH'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lenzlenz' = '"%ProgramFiles%\Innkeeper\ran.exe" SH'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\charlottesville.lnk
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /im chrome.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\blg20kh18kh03lbx02blgkh[7].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\blg20kh18kh03lbx02blgkh[8].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\blg20kh18kh03lbx02blgkh[5].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\blg20kh18kh03lbx02blgkh[6].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[4].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[5].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[2].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[3].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\blg20kh18kh03lbx02blgkh[2].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\blg20kh18kh03lbx02blgkh[3].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[10].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[11].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\blg20kh18kh03lbx02blgkh[3].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\blg20kh18kh03lbx02blgkh[4].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\blg20kh18kh03lbx02blgkh[4].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\blg20kh18kh03lbx02blgkh[2].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[15].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[16].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[14].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[12].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[15].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\blg20kh18kh03lbx02blgkh[5].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[13].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[14].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[8].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[9].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[6].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[7].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[12].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[13].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[10].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[11].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[9].html
- %ProgramFiles%\Ayios\ran.exe
- <LS_APPDATA>\ran.exe
- %TEMP%\nsi2.tmp\Microsoft.Win32.TaskScheduler.dll
- %TEMP%\nsi2.tmp\111561.exe
- %TEMP%\nsa5.tmp\SimpleFC.dll
- %TEMP%\nsf7.tmp\AccessControl.dll
- %ProgramFiles%\Innkeeper\ran.exe
- %ProgramFiles%\sears\sears.exe
- %TEMP%\nsi2.tmp\49524.exe
- %TEMP%\nsi2.tmp\62257.exe
- %TEMP%\nsi2.tmp\AccessControl.dll
- %TEMP%\nsi2.tmp\14920.exe
- %TEMP%\nsi2.tmp\123389.exe
- %TEMP%\nsi2.tmp\NMjustus.exe
- %TEMP%\nsi2.tmp\88166.exe
- %TEMP%\nsi2.tmp\98656.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[3].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[4].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\blg20kh18kh03lbx02blgkh[1].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[2].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[7].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[8].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[5].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[6].html
- %TEMP%\nsqB.tmp\nsExec.dll
- %TEMP%\nsqB.tmp\nsC.tmp
- %ProgramFiles%\wollstonecraft\fulminant.exe
- %WINDIR%\ran.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\blg20kh18kh03lbx02blgkh[1].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\blg20kh18kh03lbx02blgkh[1].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blg20kh18kh03lbx02blgkh[1].html
- %TEMP%\nssE.tmp\ShellLink.dll
Deletes the following files:
- %TEMP%\nssE.tmp\ShellLink.dll
- %TEMP%\nsf7.tmp\AccessControl.dll
- %TEMP%\nsa5.tmp\SimpleFC.dll
Moves the following files:
- from %WINDIR%\ran.exe to %WINDIR%\mags.exe
- from %ProgramFiles%\Ayios\ran.exe to %ProgramFiles%\Ayios\ran.dll
- from %ProgramFiles%\Ayios\ran.exe to %ProgramFiles%\Ayios\Ayios.exe
Substitutes the following files:
- %ProgramFiles%\Ayios\ran.exe
Modifies the HOSTS file.
Network activity:
Connects to:
- 'ww##.##okerslauri.pw':80
- 'localhost':1045
- 'ch###rslauri.pw':80
- 'localhost':1037
- 'localhost':1038
TCP:
HTTP GET requests:
- http://ww##.##okerslauri.pw/blg20kh18kh03lbx02blgkh.html?Jq##################
- http://www.ch###rslauri.pw/blg20kh18kh03lbx02blgkh.html?Jq################## via ch###rslauri.pw
UDP:
- DNS ASK ww##.##okerslauri.pw
- DNS ASK www.ch###rslauri.pw
Miscellaneous:
Searches for the following windows:
- ClassName: 'Chrome_WidgetWin_0' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%TEMP%\nsi2.tmp\62257.exe'
- '%ProgramFiles%\wollstonecraft\fulminant.exe'
- '%TEMP%\nsi2.tmp\111561.exe'
- '%TEMP%\nsqB.tmp\nsC.tmp' taskkill /im chrome.exe
- '%TEMP%\nsi2.tmp\98656.exe'
- '%TEMP%\nsi2.tmp\88166.exe'
- '%TEMP%\nsi2.tmp\NMjustus.exe' "%ProgramFiles%\sears\sears.exe" "k53238208"
- '%TEMP%\nsi2.tmp\49524.exe'
- '%TEMP%\nsi2.tmp\123389.exe'
- '%TEMP%\nsi2.tmp\NMjustus.exe' "%ProgramFiles%\Ayios\ran.exe" "34753000"
- '%TEMP%\nsi2.tmp\NMjustus.exe' "%ProgramFiles%\Innkeeper\ran.exe" "53238208"
- '%ProgramFiles%\Innkeeper\ran.exe' SH
- '%TEMP%\nsi2.tmp\NMjustus.exe' "<LS_APPDATA>\ran.exe" "13366267"
