Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Flags' = '00000043'
Modifies file system
Creates the following files
- %TEMP%\bfc5.tmp\c005.tmp\c006.bat
- %ProgramFiles(x86)%\virtools\3d life player\managers\vslmanager.dll
- %ProgramFiles(x86)%\virtools\3d life player\managers\videomanager.dll
- %ProgramFiles(x86)%\virtools\3d life player\managers\parameteroperations.dll
- %ProgramFiles(x86)%\virtools\3d life player\managers\dx7soundmanager.dll
- %ProgramFiles(x86)%\virtools\3d life player\managers\dx5inputmanager.dll
- %ProgramFiles(x86)%\virtools\3d life player\managers\ckfemgr.dll
- %ProgramFiles(x86)%\virtools\3d life player\managers\ai.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\vrunlua.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\xmlmanager.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\selectionsetmanager.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\xinputcontroller.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\worldenvironments.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\visuals.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\video.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\sounds.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\shader.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\physics.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\particlesystems.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\narratives.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\midimanager.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\multiuserclient.dll
- %ProgramFiles(x86)%\virtools\3d life player\managers\vsmanager2.dll
- %ProgramFiles(x86)%\virtools\3d life player\managers\webmanager.dll
- %TEMP%\virtoolswebplayer.log
- %ProgramFiles(x86)%\virtools\3d life player\renderengines\ckglrasterizer.ini
- %ProgramFiles(x86)%\virtools\3d life player\renderengines\ckstripper.dll
- %ProgramFiles(x86)%\virtools\3d life player\renderengines\ckglrasterizer.dll
- %ProgramFiles(x86)%\virtools\3d life player\renderengines\ckdx9rasterizer.dll
- %ProgramFiles(x86)%\virtools\3d life player\renderengines\ck2_3d.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\xloader.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\wavreader.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\virtoolsloader.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\pngloader.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\cameras.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\jpgloader.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\imagereader.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\dx9videomanager.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\ddsreader9.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\avireader.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\ascloader.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\3dsloader.dll
- %ProgramFiles(x86)%\virtools\3d life player\managers\vscriptmanager.dll
- %ProgramFiles(x86)%\virtools\3d life player\managers\webservermanager.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\meshmodifiers.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\materials.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\logics.dll
- %ProgramFiles(x86)%\virtools\3d life player\nsi4xscriptablepluginvirtools.xpt
- %ProgramFiles(x86)%\virtools\3d life player\npvirtools.dll
- %ProgramFiles(x86)%\virtools\3d life player\nk2.dll
- %ProgramFiles(x86)%\virtools\3d life player\3dviaplayerupdater.exe
- %ProgramFiles(x86)%\virtools\3d life player\loading.vmo
- %ProgramFiles(x86)%\virtools\3d life player\font_rendermanager.tga
- %ProgramFiles(x86)%\virtools\3d life player\config.dll
- %ProgramFiles(x86)%\virtools\3d life player\ckzlib.dll
- %ProgramFiles(x86)%\virtools\3d life player\ck2.dll
- nul
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ah7d7hpq\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ddijihne\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\xlpj5813\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\lhtexruw\desktop.ini
- %APPDATA%\microsoft\windows\cookies\desktop.ini
- %APPDATA%\microsoft\windows\iecompatcache\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022060120220602\index.dat
- <Current directory>\3dlifeplayer.msi
- %ProgramFiles(x86)%\virtools\3d life player\virtoolsview.dll
- %ProgramFiles(x86)%\virtools\3d life player\vslrt.dll
- %ProgramFiles(x86)%\virtools\3d life player\vcrypt.dll
- %ProgramFiles(x86)%\virtools\3d life player\vsutils.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\lights.dll
- %ProgramFiles(x86)%\virtools\3d life player\vxmath.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\interface.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\grids.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\downloadmediaclient2.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\downloadcomponentclient.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\databaseclientmodule2.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\cryptedloader.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\controllers.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\collisions.dll
- %ProgramFiles(x86)%\virtools\3d life player\plugins\tiffreader.dll
- %ALLUSERSPROFILE%\3dvia\3dvia player\config.3dl
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\buildingblocksaddons3.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\buildingblocksaddons2.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\buildingblocksaddons1.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\3dtransfo.dll
- %ProgramFiles(x86)%\virtools\3d life player\cggl.dll
- %ProgramFiles(x86)%\virtools\3d life player\cg.dll
- %ProgramFiles(x86)%\virtools\3d life player\webplayerconfig.exe
- %ProgramFiles(x86)%\virtools\3d life player\webplayer.ocx
- %ProgramFiles(x86)%\virtools\3d life player\lua51.dll
- %ProgramFiles(x86)%\virtools\3d life player\buildingblocks\characters.dll
- %APPDATA%\microsoft\installer\{f06365ec-061e-48c3-b761-e1816658d618}\appico
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\cookies\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\lhtexruw\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\xlpj5813\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ddijihne\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ah7d7hpq\desktop.ini
Deletes the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022060120220602\index.dat
Modifies the following files
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Windows\History\History.IE5\desktop.ini
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\Content.IE5\desktop.ini
Network activity
Connects to
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\BFC5.tmp\C005.tmp\C006.bat <Full path to file>"
- '<SYSTEM32>\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\formula-n2o.ru" /v http
- '<SYSTEM32>\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\formula-n2o.ru" /v http
- '<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\formula-n2o.ru" /v "http" /t REG_DWORD /d 00000002
- '<SYSTEM32>\cmd.exe' /c REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v Flags
- '<SYSTEM32>\reg.exe' QUERY "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v Flags
- '<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v "Flags" /t REG_DWORD /d 67 /f
- '<SYSTEM32>\rundll32.exe' InetCpl.cpl,ClearMyTracksByProcess 1
- '%ProgramFiles%\internet explorer\iexplore.exe' -ResetDestinationList
- '<SYSTEM32>\rundll32.exe' InetCpl.cpl,ClearMyTracksByProcess 2
- '<SYSTEM32>\rundll32.exe' InetCpl.cpl,ClearMyTracksByProcess 8
- '<SYSTEM32>\ping.exe' -n 2 localhost
- '<SYSTEM32>\msiexec.exe' /i "<Current directory>\3DLifePlayer.msi"
- '%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Virtools\3D Life Player\WebPlayer.ocx"
