Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Safe Browsere' = 'C:\\Program Files (x86)\\Safe Browsing\\Safe_Browsing.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Windows Event Log Viewer] 'ImagePath' = '"%WINDIR%\Win Services\winevent.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\Windows Event Log Viewer] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\Win Services\startup.bat" "
- '%ProgramFiles%\Safe Browsing\Safe_Browsing.exe' /Passive /NORESTART
- '<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Safe Browsere" /d "C:\\Program Files\\Safe Browsing\\Safe_Browsing.exe"
- '<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "Safe Browsere" /d "C:\\Program Files (x86)\\Safe Browsing\\Safe_Browsing.exe"
- '%TEMP%\is-J5T1H.tmp\sb.tmp' /SL5="$40036,529818,56832,%TEMP%\7ZipSfx.000\sb.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\7ZipSfx.000\sb.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%WINDIR%\Win Services\winevent.exe'
- '%WINDIR%\Win Services\winevent.exe' --install
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.exe.config
- %ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.exe
- %ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.pdb
- %ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.vshost.exe.config
- %ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.vshost.exe
- %ALLUSERSPROFILE%\Application Data\Browser Data\NDde.dll
- %WINDIR%\Win Services\winevent.InstallState
- %WINDIR%\Win Services\winevent.InstallLog
- %ALLUSERSPROFILE%\Application Data\Browser Data\Browser_voice.wav
- %ALLUSERSPROFILE%\Application Data\Browser Data\Microsoft.Win32.TaskScheduler.dll
- %ALLUSERSPROFILE%\Application Data\Browser Data\Interop.SHDocVw.dll
- %WINDIR%\Win Services\WinLogFile.txt
- %ProgramFiles%\Safe Browsing\Microsoft.Win32.TaskScheduler.dll
- %WINDIR%\Browser Data\Interop.SHDocVw.dll
- %WINDIR%\Browser Data\Microsoft.Win32.TaskScheduler.dll
- %WINDIR%\Browser Data\NDde.dll
- %ProgramFiles%\Safe Browsing\NDde.dll
- %ProgramFiles%\Safe Browsing\Interop.SHDocVw.dll
- %ALLUSERSPROFILE%\Application Data\Browser Data\unins000.dat
- %ALLUSERSPROFILE%\Application Data\Browser Data\Safe_Browsing.vshost.exe.manifest
- %ALLUSERSPROFILE%\Application Data\Browser Data\unins000.exe
- %WINDIR%\Browser Data\Browser_voice.wav
- %ProgramFiles%\Safe Browsing\Browser_voice.wav
- %WINDIR%\Win Services\InstallUtil.InstallLog
- %WINDIR%\Win Services\is-E9648.tmp
- %WINDIR%\Win Services\is-AOK47.tmp
- %WINDIR%\Win Services\is-7BI9K.tmp
- %WINDIR%\Win Services\is-HV6C5.tmp
- %WINDIR%\Win Services\is-LIHUR.tmp
- %WINDIR%\Win Services\is-RFM1R.tmp
- %TEMP%\is-J5T1H.tmp\sb.tmp
- %TEMP%\7ZipSfx.000\sb.exe
- %TEMP%\is-U1GKJ.tmp\_isetup\_shfoldr.dll
- %ProgramFiles%\Safe Browsing\is-QPJCE.tmp
- %TEMP%\is-U1GKJ.tmp\isxdl.dll
- %WINDIR%\Win Services\is-NQ2V1.tmp
- %ProgramFiles%\Safe Browsing\is-IG6P0.tmp
- %ProgramFiles%\Safe Browsing\is-Q006I.tmp
- %ProgramFiles%\Safe Browsing\is-I2AUE.tmp
- %ProgramFiles%\Safe Browsing\unins000.dat
- %ProgramFiles%\Safe Browsing\is-9JO7T.tmp
- %ProgramFiles%\Safe Browsing\is-T18U4.tmp
- %ProgramFiles%\Safe Browsing\is-ROIIB.tmp
- %ProgramFiles%\Safe Browsing\is-N3AEH.tmp
- %ProgramFiles%\Safe Browsing\is-P4GKM.tmp
- %ProgramFiles%\Safe Browsing\is-AQK1S.tmp
- %ProgramFiles%\Safe Browsing\is-2VQCM.tmp
Deletes the following files:
- %TEMP%\is-J5T1H.tmp\sb.tmp
- %TEMP%\7ZipSfx.000\sb.exe
- <SYSTEM32>\d3d9caps.dat
- %TEMP%\is-U1GKJ.tmp\isxdl.dll
- %TEMP%\is-U1GKJ.tmp\_isetup\_shfoldr.dll
Moves the following files:
- from %ProgramFiles%\Safe Browsing\is-2VQCM.tmp to %ProgramFiles%\Safe Browsing\NDde.dll
- from %ProgramFiles%\Safe Browsing\is-AQK1S.tmp to %ProgramFiles%\Safe Browsing\Safe_Browsing.exe
- from %ProgramFiles%\Safe Browsing\is-ROIIB.tmp to %ProgramFiles%\Safe Browsing\Interop.SHDocVw.dll
- from %ProgramFiles%\Safe Browsing\is-P4GKM.tmp to %ProgramFiles%\Safe Browsing\Microsoft.Win32.TaskScheduler.dll
- from %ProgramFiles%\Safe Browsing\is-T18U4.tmp to %ProgramFiles%\Safe Browsing\Safe_Browsing.exe.config
- from %ProgramFiles%\Safe Browsing\is-I2AUE.tmp to %ProgramFiles%\Safe Browsing\Safe_Browsing.vshost.exe.config
- from %ProgramFiles%\Safe Browsing\is-9JO7T.tmp to %ProgramFiles%\Safe Browsing\Safe_Browsing.vshost.exe.manifest
- from %ProgramFiles%\Safe Browsing\is-Q006I.tmp to %ProgramFiles%\Safe Browsing\Safe_Browsing.pdb
- from %ProgramFiles%\Safe Browsing\is-IG6P0.tmp to %ProgramFiles%\Safe Browsing\Safe_Browsing.vshost.exe
- from %WINDIR%\Win Services\is-AOK47.tmp to %WINDIR%\Win Services\winevent.exe
- from %WINDIR%\Win Services\is-E9648.tmp to %WINDIR%\Win Services\winevent.exe.config
- from %ProgramFiles%\Safe Browsing\is-QPJCE.tmp to %ProgramFiles%\Safe Browsing\unins000.exe
- from %WINDIR%\Win Services\is-RFM1R.tmp to %WINDIR%\Win Services\startup.bat
- from %WINDIR%\Win Services\is-7BI9K.tmp to %WINDIR%\Win Services\winevent.pdb
- from %WINDIR%\Win Services\is-NQ2V1.tmp to %WINDIR%\Win Services\winevent.vshost.exe.manifest
- from %ProgramFiles%\Safe Browsing\is-N3AEH.tmp to %ProgramFiles%\Safe Browsing\Browser_voice.wav
- from %WINDIR%\Win Services\is-LIHUR.tmp to %WINDIR%\Win Services\winevent.vshost.exe
- from %WINDIR%\Win Services\is-HV6C5.tmp to %WINDIR%\Win Services\winevent.vshost.exe.config
Network activity:
Connects to:
- 'ga###upport.com':80
TCP:
HTTP POST requests:
- http://ga###upport.com/webservices/service.asmx/Browser_Hijacker_TraceRecord
UDP:
- DNS ASK ga###upport.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
