Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- <DRIVERS>\etc\hosts.ics
- %LOCALAPPDATA%\microsoft\windows\inetcookies\deprecated.cookie
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\76rm8sd1\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\eluoynpb\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\s4nnq32k\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\76rm8sd1\background_gradient[1]
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\eluoynpb\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\s4nnq32k\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\76rm8sd1\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\eluoynpb\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\s4nnq32k\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\eluoynpb\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\76rm8sd1\dnserrordiagoff[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\76rm8sd1\newerrorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\errorpagestrings[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\httperrorpagesscripts[1]
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\76rm8sd1\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\eluoynpb\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\s4nnq32k\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\eluoynpb\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\76rm8sd1\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\eluoynpb\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\errorpagestrings[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\76rm8sd1\dnserrordiagoff[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\s4nnq32k\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\eluoynpb\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\76rm8sd1\newerrorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\76rm8sd1\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\jzm4v3j8\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\s4nnq32k\info_48[1]
Modifies the following files
- %HOMEPATH%\desktop\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk
Modifies the HOSTS file.
Network activity
UDP
- DNS ASK cf######9.googlecode.com
- DNS ASK fa##f.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%ProgramFiles(x86)%\internet explorer\ielowutil.exe' -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
- '%ProgramFiles%\internet explorer\iexplore.exe' -Embedding
