Trojan.FakeAV.15462

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

Creates and executes the following:

'%TEMP%\nsz2.tmp\nsC.tmp' xcopy "C:\ProgramData\Microsoft\Windows\DRM\Server\xtx.exe" "<SYSTEM32>" /H /Y /K
'%TEMP%\nsz2.tmp\nsB.tmp' xcopy "<Current directory>\xlaunch.exe" "<SYSTEM32>" /H /Y /K
'%TEMP%\nsz2.tmp\nsA.tmp' xcopy "<Current directory>\xlaunch.exe" "C:\ProgramData\Microsoft\Windows\DRM\Server" /H /Y /K
'%TEMP%\nsz2.tmp\nsF.tmp' taskkill.exe /F /IM xlaunch.exe
'%TEMP%\nsz2.tmp\nsE.tmp' xcopy "C:\ProgramData\Microsoft\Windows\DRM\Server\xlaunch.exe" "%WINDIR%\security\logs" /H /Y /K
'%TEMP%\nsz2.tmp\nsD.tmp' xcopy "C:\ProgramData\Microsoft\Windows\DRM\Server\xtx.exe" "%WINDIR%\security\logs" /H /Y /K
'%TEMP%\nsz2.tmp\ns9.tmp' xcopy "C:\ProgramData\Microsoft\Windows\DRM\Server\v.txt" "%WINDIR%" /H /Y
'%TEMP%\nsz2.tmp\ns5.tmp' attrib +r +a +s +h C:\ProgramData\Microsoft
'%TEMP%\nsz2.tmp\ns4.tmp' attrib +r +a +s +h C:\ProgramData
'%TEMP%\nsz2.tmp\ns3.tmp' ftype .log=exefile
'%TEMP%\nsz2.tmp\ns8.tmp' attrib +r +a +s +h C:\ProgramData\Microsoft\Windows\DRM\Server
'%TEMP%\nsz2.tmp\ns7.tmp' attrib +r +a +s +h C:\ProgramData\Microsoft\Windows\DRM
'%TEMP%\nsz2.tmp\ns6.tmp' attrib +r +a +s +h C:\ProgramData\Microsoft\Windows

Executes the following:

'<SYSTEM32>\xcopy.exe' "C:\ProgramData\Microsoft\Windows\DRM\Server\xtx.exe" "<SYSTEM32>" /H /Y /K
'<SYSTEM32>\xcopy.exe' "<Current directory>\xlaunch.exe" "<SYSTEM32>" /H /Y /K
'<SYSTEM32>\xcopy.exe' "<Current directory>\xlaunch.exe" "C:\ProgramData\Microsoft\Windows\DRM\Server" /H /Y /K
'<SYSTEM32>\taskkill.exe' /F /IM xlaunch.exe
'<SYSTEM32>\xcopy.exe' "C:\ProgramData\Microsoft\Windows\DRM\Server\xlaunch.exe" "%WINDIR%\security\logs" /H /Y /K
'<SYSTEM32>\xcopy.exe' "C:\ProgramData\Microsoft\Windows\DRM\Server\xtx.exe" "%WINDIR%\security\logs" /H /Y /K
'<SYSTEM32>\attrib.exe' +r +a +s +h C:\ProgramData\Microsoft\Windows
'<SYSTEM32>\attrib.exe' +r +a +s +h C:\ProgramData\Microsoft
'<SYSTEM32>\attrib.exe' +r +a +s +h C:\ProgramData
'<SYSTEM32>\xcopy.exe' "C:\ProgramData\Microsoft\Windows\DRM\Server\v.txt" "%WINDIR%" /H /Y
'<SYSTEM32>\attrib.exe' +r +a +s +h C:\ProgramData\Microsoft\Windows\DRM\Server
'<SYSTEM32>\attrib.exe' +r +a +s +h C:\ProgramData\Microsoft\Windows\DRM

Modifies settings of Windows Internet Explorer:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Attachments] 'SaveZoneInformation' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations] 'LowRiskFileTypes' = '.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.log;'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.log;'

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ext[1].zip
C:\ProgramData\Microsoft\Windows\DRM\Server\xtx.zip
%TEMP%\nsz2.tmp\ZipDLL.dll
C:\ProgramData\Microsoft\Windows\DRM\Server\v.txt
%TEMP%\nsz2.tmp\ns9.tmp
%WINDIR%\v.txt
%TEMP%\nsz2.tmp\nsD.tmp
%TEMP%\nsz2.tmp\nsE.tmp
%TEMP%\nsz2.tmp\nsF.tmp
%TEMP%\nsz2.tmp\nsA.tmp
%TEMP%\nsz2.tmp\nsB.tmp
%TEMP%\nsz2.tmp\nsC.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\v[1].txt
%TEMP%\nsz2.tmp\nsExec.dll
%TEMP%\nsz2.tmp\ns3.tmp
%TEMP%\nsz2.tmp\ns4.tmp
%TEMP%\nsz2.tmp\System.dll
%TEMP%\nsz2.tmp\NSISArray.dll
%TEMP%\nsz2.tmp\UserMgr.dll
%TEMP%\nsz2.tmp\ns8.tmp
%TEMP%\nsz2.tmp\AccessControl.dll
%TEMP%\nsz2.tmp\inetc.dll
%TEMP%\nsz2.tmp\ns5.tmp
%TEMP%\nsz2.tmp\ns6.tmp
%TEMP%\nsz2.tmp\ns7.tmp

Deletes the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

Miscellaneous:

Searches for the following windows: