Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\iexplore
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe;.bat;.cmd;.vbs'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe;.bat;.cmd;.vbs'
Modifies file system
Creates the following files
- %TEMP%\fixauto.exe
- %APPDATA%\iexplore.exe
- %TEMP%\tmp2de3.tmp.bat
- nul
Network activity
Connects to
- 'se####.b92dt.com':63979
TCP
HTTP GET requests
- http://fr##.##meanddate.com/clock/i3jl68nm/n246/tlir/tt0/tw0/tm3/th1
UDP
- DNS ASK ut#####.colorado.edu
- DNS ASK ti##.ien.it
- DNS ASK ti##.nist.gov
- DNS ASK pt###me1.ptb.de
- DNS ASK fr##.##meanddate.com
- DNS ASK sv##uto.com
- DNS ASK se####.b92dt.com
Miscellaneous
Searches for the following windows
- ClassName: 'Sword3 Class' WindowName: ''
Creates and executes the following
- '%TEMP%\fixauto.exe'
- '%APPDATA%\iexplore.exe'
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "iexplore" /tr '"%APPDATA%\iexplore.exe"' & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "iexplore" /tr '"%APPDATA%\iexplore.exe"' & exit
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tmp2DE3.tmp.bat""
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc onlogon /rl highest /tn "iexplore" /tr '"%APPDATA%\iexplore.exe"'
- '%WINDIR%\syswow64\timeout.exe' 3
