Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:7788;https=127.0.0.1:7788'
Modifies file system
Creates the following files
- <Current directory>\fiddlercore4.dll
- <Current directory>\efd.dll
- <Current directory>\ssleay32.dll
- <Current directory>\libeay32.dll
- <Current directory>\makecert.exe
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\401e57d2a2ad3ae818b720df9f9e2278_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %APPDATA%\microsoft\systemcertificates\request\certificates\80bc53be4125ef93089f5f868c4acb0b02f80366
- %APPDATA%\microsoft\systemcertificates\my\certificates\c7f19a7ed9022a40f199639eb4ada98e83d77b49
- %APPDATA%\microsoft\systemcertificates\my\keys\3f612be331a55bd2099ea69a71a3e43ecb863349
- %TEMP%\tmpee24.tmp
- %TEMP%\tmpef2f.tmp
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\7438800e270f3e80beac70d36f351218_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\841a186c8f7b74cbde0c6ea6c2d04a2f_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %APPDATA%\microsoft\systemcertificates\request\certificates\cab3690321bc101ff02c8eecfe264db2f9abaec3
- %APPDATA%\microsoft\systemcertificates\my\certificates\1255415e0c5cb874b6d24fc8315dabb81c9862b2
- %APPDATA%\microsoft\systemcertificates\my\keys\b2b4c023a1714228ca913fb9ca2f477541e7ccab
- %TEMP%\tmp18f.tmp
- %TEMP%\tmp190.tmp
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\2d4e9523e7a3edc4e03e64c5b65f38bb_8cf7b530-613e-439b-a8c5-ccfc0e745400
Deletes following files that it created itself
- %APPDATA%\microsoft\systemcertificates\request\certificates\80bc53be4125ef93089f5f868c4acb0b02f80366
- %TEMP%\tmpee24.tmp
- %TEMP%\tmpef2f.tmp
- %APPDATA%\microsoft\systemcertificates\request\certificates\cab3690321bc101ff02c8eecfe264db2f9abaec3
- %TEMP%\tmp18f.tmp
- %TEMP%\tmp190.tmp
Network activity
Connects to
- 'localhost':7788
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?cd##############
Other
- 'localhost':49697
- 'localhost':49701
Miscellaneous
Executes the following
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s NgcSvc
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
