Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Classes\.hzdh\shell\open\command] '' = 'IEXPLORE.EXE http://www.35yes.com/?wj'
- [<HKLM>\SOFTWARE\Classes\.hzyx\shell\open\command] '' = 'IEXPLORE.EXE http://www.d91d.com/?wj'
- [<HKLM>\SOFTWARE\Classes\.hztb\shell\open\command] '' = 'IEXPLORE.EXE http://taobao.loliso.com/?wj'
- [<HKLM>\Software\Classes\.\shell\open\command\] '' = 'rundll32.exe %WINDIR%\staticial\cmss.jyc,scanMiddle'
- [<HKLM>\Software\Classes\ttc\shell\open\command\] '' = '%ProgramFiles%\MOZILL~1\firefox.exe http:\\www.henbucuo.com\?new'
- [<HKLM>\Software\Classes\ttf\shell\open\command\] '' = '%ProgramFiles%\Opera\launcher.exe http:\\www.henbucuo.com\?new'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- file extensions
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' http://dl.###link.cn:1287/CPAdown/haozip_tiny.200629.html
- '%ProgramFiles%\internet explorer\iexplore.exe' http://dl.###link.cn:1287/CPAdown/vplay.html
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- C:\users\public\desktop\internet expleror.hzdh
- C:\internet expleror.hzdh
- %ALLUSERSPROFILE%\microsoft\windows\start menu\internet expleror.hzdh
- C:\wi67e.exe
- %ProgramFiles%\staticial\cmss.jyc
- %WINDIR%\staticial\cmss.jyc
- %ProgramFiles%\staticial\csrg.jpc
- %WINDIR%\staticial\csrg.jpc
- %ProgramFiles%\staticial\config.ini
- %WINDIR%\staticial\config.ini
- C:\lvek6r.exe
- %WINDIR%\temp\2020.tmp
- %WINDIR%\data.dat
- %ProgramFiles%\internet explorer\hmmapis.dll
- %ProgramFiles%\staticial\dd.vbs
- C:\oied.bak.vbs
Sets the 'hidden' attribute to the following files
- C:\users\public\desktop\internet expleror.hzdh
- C:\internet expleror.hzdh
- %ALLUSERSPROFILE%\microsoft\windows\start menu\internet expleror.hzdh
- C:\wi67e.exe
- C:\lvek6r.exe
Deletes the following files
- %WINDIR%\temp\2020.tmp
- C:\wi67e.exe
- C:\oied.bak.vbs
- %ProgramFiles%\staticial\dd.vbs
Network activity
UDP
- DNS ASK dl.##nlink.cn
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "c:\oied.bak.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%ProgramFiles%\staticial\dd.vbs"
- 'C:\lvek6r.exe'
- 'C:\wi67e.exe'
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r Users' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r "user' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r "Authenticated Users"' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r "Power Users"' (with hidden window)
- 'C:\wi67e.exe' ' (with hidden window)
- 'C:\lvek6r.exe' ' (with hidden window)
- '%ProgramFiles%\internet explorer\iexplore.exe' http://dl.###link.cn:1287/CPAdown/haozip_tiny.200629.html' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' %WINDIR%\staticial\cmss.jyc,scanMiddle' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' "%ProgramFiles%\staticial\dd.vbs"' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' "c:\oied.bak.vbs"' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /G Everyone:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all > %WINDIR%\Temp\2020.tmp' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r Administrators' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r "Power Users"' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /G Everyone:r' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r Administrators' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r Users' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r Administrators' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r System' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r "Power Users"' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r "Authenticated Users"' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r "user' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r System' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r "Authenticated Users"' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /G Everyone:r' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r Users' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r "user' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r System' (with hidden window)
- '%ProgramFiles%\internet explorer\iexplore.exe' http://dl.###link.cn:1287/CPAdown/vplay.html' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /G Everyone:r
- '%WINDIR%\syswow64\rundll32.exe' %WINDIR%\staticial\cmss.jyc,scanMiddle
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all > %WINDIR%\Temp\2020.tmp
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r "Power Users"
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r "Authenticated Users"
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r "user
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r Users
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r System
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /r Administrators
- '%WINDIR%\syswow64\cacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Internet Expleror.hzdh" /e /c /G Everyone:r
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r "Power Users"
- '%WINDIR%\syswow64\ipconfig.exe' /all
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r "Authenticated Users"
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r Users
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /G Everyone:r
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r "Authenticated Users"
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r System
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r Administrators
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r "user
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r "Power Users"
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r System
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r Administrators
- '%WINDIR%\syswow64\cacls.exe' "C:\Users\Public\Desktop\Internet Expleror.hzdh" /e /c /r Users
- '%WINDIR%\syswow64\cacls.exe' "\Internet Expleror.hzdh" /e /c /r "user
- '%WINDIR%\syswow64\rundll32.exe' C:\Progra~1\staticial\csrg.jpc,scanCook
