Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{078EE8AC-3825-41EB-BADB-A8A4F21A6A56}] 'Exec' = 'http://www.72227.cn'
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0036A2BA-F043-481D-81B1-BF9761EDB7DE}] 'Exec' = 'http://www.sw777.cn'
Creates the following files on removable media:
- <Drive name for removable media>:\快捷上网.url
Malicious functions:
Executes the following:
- <SYSTEM32>\ping.exe 127.0.0.1 -n 3
- %WINDIR%\explorer.exe /e,<Current directory>
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Favorites\金牌网址大全\好站Pk小游戏 } 22226.cn.url
- %TEMP%\aut11.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut13.tmp
- %HOMEPATH%\Favorites\好站金牌网址 } 72227.cn.url
- %TEMP%\autF.tmp
- %HOMEPATH%\Favorites\金牌网址大全\好站在线娱乐视频 } 63336.cn.url
- %HOMEPATH%\Favorites\金牌网址大全\好站男欢女爱 } 53335.cn.url
- %HOMEPATH%\Favorites\金牌网址大全\好站劲爆网游.url
- %TEMP%\aut10.tmp
- %HOMEPATH%\Favorites\金牌网址大全\好站网络电视 } 27772.cn.url
- %TEMP%\aut18.tmp
- %TEMP%\aut17.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\淘宝网.url
- %ALLUSERSPROFILE%\Desktop\Internet Explorer.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
- %HOMEPATH%\Favorites\好站2127 } so11.cn.url
- %TEMP%\aut14.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut16.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\好站so11.cn.url
- %TEMP%\autE.tmp
- %TEMP%\aut4.tmp
- <SYSTEM32>\baidu.ico
- %HOMEPATH%\Favorites\快捷上网.url
- C:\快捷上网.url
- %TEMP%\aut5.tmp
- <SYSTEM32>\OemLink.ico
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- <SYSTEM32>\OemLinksw.ico
- %TEMP%\aut6.tmp
- %TEMP%\autC.tmp
- %PROGRAM_FILES%\快捷上网.url
- %HOMEPATH%\Favorites\金牌网址大全\好站小游戏 } 31113.cn.url
- %HOMEPATH%\Favorites\金牌网址大全\好站在线高清电影 } 50588.cn.url
- %TEMP%\autD.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autB.tmp
- %TEMP%\autA.tmp
Deletes the following files:
- %TEMP%\aut10.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut12.tmp
- %TEMP%\autD.tmp
- %TEMP%\autE.tmp
- %TEMP%\autF.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\autA.tmp
- %TEMP%\autB.tmp
- %TEMP%\autC.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut9.tmp
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'GINA Logon'
- ClassName: '' WindowName: ''
