Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\wermgr.exe' -queuereporting
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\WININET.dll",DispatchAPICall 1
- '<SYSTEM32>\ctfmon.exe'
- '<SYSTEM32>\makecab.exe' /V1 %TEMP%\\cryptbase.dll %TEMP%\\cryptbase.msu
- '<SYSTEM32>\sysprep\sysprep.exe'
- '<SYSTEM32>\wusa.exe' %TEMP%\\cryptbase.msu /extract:<SYSTEM32>\sysprep
Injects code into
the following system processes:
- <SYSTEM32>\Dwm.exe
Modifies file system :
Creates the following files:
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\ajax[1].php
- %TEMP%\95CC.tmp
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\SOXZEUJX\ajax[1].php
- %TEMP%\844B.tmp
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\ajax[1].php
- %TEMP%\8AC2.tmp
- %TEMP%\A6C0.tmp
- %TEMP%\A152.tmp
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\BOWDBRP7\ajax[2].php
- %TEMP%\8E6B.tmp
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ajax[2].php
- %TEMP%\9ACC.tmp
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\ajax[2].php
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ajax[1].php
- %TEMP%\cab_1780_4
- %TEMP%\cab_1780_6
- %TEMP%\cab_1780_5
- %TEMP%\cryptbase.dll
- %TEMP%\cab_1780_2
- %TEMP%\cab_1780_3
- %TEMP%\cryptbase.msu
- <SYSTEM32>\sysprep\Panther\setupact.log
- C:\ProgramData\fimunyz64.exe
- <SYSTEM32>\sysprep\$dpx$.tmp\de5a9c95f4072b449b058adfb5a14c26.tmp
- <SYSTEM32>\sysprep\Panther\diagerr.xml
- <SYSTEM32>\sysprep\Panther\diagwrn.xml
Deletes the following files:
- %TEMP%\A6C0.tmp
- %TEMP%\95CC.tmp
- %TEMP%\8AC2.tmp
- %TEMP%\8E6B.tmp
- %TEMP%\A152.tmp
- %TEMP%\9ACC.tmp
- %TEMP%\844B.tmp
- %TEMP%\cab_1780_4
- %TEMP%\cab_1780_3
- %TEMP%\cab_1780_2
- <SYSTEM32>\sysprep\cryptbase.dll
- %TEMP%\cab_1780_6
- %TEMP%\cab_1780_5
Moves the following files:
- from <SYSTEM32>\sysprep\$dpx$.tmp\de5a9c95f4072b449b058adfb5a14c26.tmp to <SYSTEM32>\sysprep\cryptbase.dll
Moves itself:
- from <Full path to virus> to %TEMP%\7B85.tmp
Deletes itself.
Network activity:
Connects to:
- 'vi###af.info':80
- 'ga###aw.info':80
- 'tu###al.info':80
- 'we###av.info':80
- 'ma###em.info':80
- 'download.windowsupdate.com':80
- 'do###es.info':80
- 'xu###ej.info':80
TCP:
HTTP GET requests:
- vi###af.info/ajax.php
- we###av.info/ajax.php
- do###es.info/ajax.php
- tu###al.info/ajax.php
- ma###em.info/ajax.php
- xu###ej.info/ajax.php
- ga###aw.info/ajax.php
UDP:
- DNS ASK tu###og.info
- DNS ASK ga###ab.info
- DNS ASK do###aw.info
- DNS ASK no###om.info
- DNS ASK vi###at.info
- DNS ASK xu###ad.info
- DNS ASK pu###ep.info
- DNS ASK ry###eg.info
- DNS ASK bo###em.info
- DNS ASK ly###ej.info
- DNS ASK ma###ac.info
- DNS ASK je###ox.info
- DNS ASK ly###oj.info
- DNS ASK vo###it.info
- DNS ASK ry###il.info
- DNS ASK ke###ix.info
- DNS ASK pu###ig.info
- DNS ASK fo###ow.info
- DNS ASK qe###ov.info
- DNS ASK we###al.info
- DNS ASK si###os.info
- DNS ASK ha###ib.info
- DNS ASK xu###id.info
- DNS ASK qe###yl.info
- DNS ASK ly###ud.info
- DNS ASK je###ij.info
- DNS ASK fo###ub.info
- DNS ASK vo###um.info
- DNS ASK ry###ug.info
- DNS ASK we###og.info
- DNS ASK ma###ok.info
- DNS ASK xu###or.info
- DNS ASK do###ob.info
- DNS ASK ly###od.info
- DNS ASK ga###iz.info
- DNS ASK ke###yj.info
- DNS ASK ci###et.info
- DNS ASK na###yc.info
- DNS ASK go###eb.info
- DNS ASK zu###yd.info
- DNS ASK di###yw.info
- DNS ASK je###ex.info
- DNS ASK qe###ul.info
- DNS ASK si###iw.info
- DNS ASK xu###ur.info
- DNS ASK ha###uz.info
- DNS ASK pu###yp.info
- DNS ASK je###ir.info
- DNS ASK ci###ik.info
- DNS ASK na###ot.info
- DNS ASK ry###iv.info
- DNS ASK go###is.info
- DNS ASK qe###iq.info
- DNS ASK vo###of.info
- DNS ASK xu###aj.info
- DNS ASK pu###ol.info
- DNS ASK di###oh.info
- DNS ASK ke###on.info
- DNS ASK bo###if.info
- DNS ASK we###uq.info
- DNS ASK tu###yv.info
- DNS ASK je###yr.info
- DNS ASK vi###yk.info
- DNS ASK no###yf.info
- DNS ASK ga###us.info
- DNS ASK ma###ut.info
- DNS ASK zu###ox.info
- DNS ASK ly###un.info
- DNS ASK xu###ux.info
- DNS ASK do###uh.info
- DNS ASK ry###av.info
- DNS ASK go###uw.info
- DNS ASK zu###uj.info
- DNS ASK ry###ul.info
- DNS ASK ma###ym.info
- DNS ASK bo###yt.info
- DNS ASK na###um.info
- DNS ASK qe###uv.info
- DNS ASK di###us.info
- DNS ASK ci###uf.info
- DNS ASK je###yn.info
- DNS ASK pu###yg.info
- DNS ASK ga###ew.info
- DNS ASK ly###ax.info
- DNS ASK je###en.info
- DNS ASK si###ah.info
- DNS ASK fo###as.info
- DNS ASK qe###aq.info
- DNS ASK we###ev.info
- DNS ASK no###et.info
- DNS ASK tu###el.info
- DNS ASK ly###yx.info
- DNS ASK vi###ef.info
- DNS ASK do###ys.info
- DNS ASK no###ic.info
- DNS ASK pu###ul.info
- DNS ASK bo###uf.info
- DNS ASK ly###yn.info
- DNS ASK ma###yt.info
- DNS ASK ga###ys.info
- DNS ASK go###us.info
- DNS ASK ci###uk.info
- DNS ASK na###it.info
- DNS ASK zu###ix.info
- DNS ASK je###ur.info
- DNS ASK ry###uv.info
- DNS ASK xu###yx.info
- DNS ASK fo###ah.info
- DNS ASK ly###en.info
- DNS ASK ry###aq.info
- DNS ASK xu###ax.info
- DNS ASK vo###ak.info
- DNS ASK je###er.info
- DNS ASK do###yh.info
- DNS ASK tu###ev.info
- DNS ASK we###yq.info
- DNS ASK vi###ek.info
- DNS ASK no###ef.info
- DNS ASK qe###uq.info
- DNS ASK tu###al.info
- DNS ASK we###av.info
- DNS ASK no###at.info
- DNS ASK ly###ex.info
- DNS ASK je###an.info
- DNS ASK vi###af.info
- DNS ASK ma###em.info
- DNS ASK download.windowsupdate.com
- DNS ASK xu###ej.info
- DNS ASK ga###aw.info
- DNS ASK do###es.info
- DNS ASK dn#.##ftncsi.com
- DNS ASK ke###in.info
- DNS ASK vo###if.info
- DNS ASK ry###ov.info
- DNS ASK di###ih.info
- DNS ASK pu###il.info
- DNS ASK fo###os.info
- DNS ASK si###oh.info
- DNS ASK ly###ox.info
- DNS ASK qe###oq.info
- DNS ASK ha###ow.info
- DNS ASK xu###oj.info
- DNS ASK ry###ep.info
- DNS ASK pu###eq.info
- DNS ASK vo###ec.info
- DNS ASK qe###yg.info
- DNS ASK ke###ed.info
- DNS ASK fo###yz.info
- DNS ASK xu###yn.info
- DNS ASK je###ud.info
- DNS ASK ly###yr.info
- DNS ASK si###yb.info
- DNS ASK ha###eh.info
- DNS ASK di###eb.info
- DNS ASK pu###oq.info
- DNS ASK ry###ap.info
- DNS ASK bo###oc.info
- DNS ASK vi###im.info
- DNS ASK tu###ip.info
- DNS ASK je###aj.info
- DNS ASK ci###am.info
- DNS ASK qe###ag.info
- DNS ASK zu###ar.info
- DNS ASK go###az.info
- DNS ASK na###ek.info
- DNS ASK vi###uc.info
- DNS ASK ry###iq.info
- DNS ASK bo###ik.info
- DNS ASK na###of.info
- DNS ASK zu###on.info
- DNS ASK qe###op.info
- DNS ASK di###oz.info
- DNS ASK ha###as.info
- DNS ASK ke###or.info
- DNS ASK si###ez.info
- DNS ASK pu###av.info
- DNS ASK qe###ep.info
- DNS ASK go###oh.info
- DNS ASK no###yk.info
- DNS ASK tu###uq.info
- DNS ASK ly###ir.info
- DNS ASK we###up.info
- DNS ASK do###uz.info
- DNS ASK ga###uh.info
- DNS ASK je###id.info
- DNS ASK ci###oc.info
- DNS ASK pu###iv.info
- DNS ASK xu###un.info
- DNS ASK ma###if.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: '????????????'
- ClassName: 'Indicator' WindowName: '(null)'
