Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\2144GameBox1834_137065.exe'
- '%PROGRAM_FILES%\2144іаФВґ«Лµ\2144LoginCycs_2001.exe'
- '%TEMP%\2144LoginCycs2001_137065.exe'
- '<SYSTEM32>\2144cycs_k61324581_137065.exe'
- '<SYSTEM32>\2144game_k61324581_137065.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\2144GameBox\skin\UserPage\add.bmp
- %APPDATA%\2144GameBox\skin\update\wndbg.bmp
- %APPDATA%\2144GameBox\skin\UserPage\btnTaoGame.bmp
- %APPDATA%\2144GameBox\skin\UserPage\checkEdit.bmp
- %APPDATA%\2144GameBox\skin\UserPage\checkAll.bmp
- %APPDATA%\2144GameBox\skin\update\btnCom.bmp
- %APPDATA%\2144GameBox\skin\update\btn.bmp
- %APPDATA%\2144GameBox\skin\update\hint.bmp
- %APPDATA%\2144GameBox\skin\update\wndClose.bmp
- %APPDATA%\2144GameBox\skin\update\pross.bmp
- %APPDATA%\2144GameBox\skin\UserPage\nextpage.bmp
- %APPDATA%\2144GameBox\skin\UserPage\mouseon.png
- %APPDATA%\2144GameBox\skin\UserPage\nopic.jpg
- %APPDATA%\2144GameBox\skin\UserPage\point.bmp
- %APPDATA%\2144GameBox\skin\UserPage\nousedBG.bmp
- %APPDATA%\2144GameBox\skin\UserPage\checkWeb.bmp
- %APPDATA%\2144GameBox\skin\UserPage\checkFlash.bmp
- %APPDATA%\2144GameBox\skin\UserPage\choseTab.bmp
- %APPDATA%\2144GameBox\skin\UserPage\lastpage.bmp
- %APPDATA%\2144GameBox\skin\UserPage\delete.png
- %APPDATA%\2144GameBox\skin\popDlg\btnReg.png
- %APPDATA%\2144GameBox\skin\popDlg\btnReg.bmp
- %APPDATA%\2144GameBox\skin\popDlg\btnRegLogin.bmp
- %APPDATA%\2144GameBox\skin\popDlg\comlistcolse.BMP
- %APPDATA%\2144GameBox\skin\popDlg\checkMulti.bmp
- %APPDATA%\2144GameBox\skin\popDlg\BtnSumbit.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\screenshot.png
- %APPDATA%\2144GameBox\skin\popDlg\CheckPoint.bmp
- %APPDATA%\2144GameBox\skin\popDlg\btnOldLogin.bmp
- %APPDATA%\2144GameBox\skin\popDlg\btnArrowhead.bmp
- %APPDATA%\2144GameBox\skin\popDlg\qqlogin.bmp
- %APPDATA%\2144GameBox\skin\popDlg\newwndbg.bmp
- %APPDATA%\2144GameBox\skin\popDlg\scroll.bmp
- %APPDATA%\2144GameBox\skin\popDlg\Йэј¶МбКѕ.png
- %APPDATA%\2144GameBox\skin\popDlg\wndbg.bmp
- %APPDATA%\2144GameBox\skin\popDlg\demo.bmp
- %APPDATA%\2144GameBox\skin\popDlg\comlistfocus.bmp
- %APPDATA%\2144GameBox\skin\popDlg\editinput.bmp
- %APPDATA%\2144GameBox\skin\popDlg\logininput.bmp
- %APPDATA%\2144GameBox\skin\popDlg\loginBar.bmp
- %APPDATA%\2144GameBox\skin\UserPage\sid.png
- %APPDATA%\2144GameBox\webPic\16.jpg
- %APPDATA%\2144GameBox\webPic\14.jpg
- %APPDATA%\2144GameBox\webPic\17.jpg
- %APPDATA%\2144GameBox\palygame.ico
- %APPDATA%\2144GameBox\webPic\8.jpg
- %APPDATA%\2144GameBox\skin\WebGame\btnSpeedDown.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnShortcut.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnSpeedUp.bmp
- %APPDATA%\2144GameBox\webPic\1.jpg
- %APPDATA%\2144GameBox\skin\WebGame\user.bmp
- %HOMEPATH%\Start Menu\Programs\2144УОП·єРЧУ\2144УОП·Нш.lnk
- %APPDATA%\2144GameBox\2144УОП·єРЧУ.url
- %HOMEPATH%\Start Menu\Programs\2144УОП·єРЧУ\Р¶ФШ.lnk
- %HOMEPATH%\Desktop\2144УОП·єРЧУ.lnk
- %HOMEPATH%\Start Menu\Programs\2144УОП·єРЧУ\2144УОП·єРЧУ.lnk
- %APPDATA%\2144GameBox\pos.dat
- %APPDATA%\2144GameBox\allround.exe
- %TEMP%\nse5.tmp\System.dll
- %TEMP%\nse5.tmp\inetc.dll
- %TEMP%\nse5.tmp\nsisdt.dll
- %APPDATA%\2144GameBox\skin\WebGame\btnBackup.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnBBS.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnDeleteCookie.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnFullScreen.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnForward.bmp
- %APPDATA%\2144GameBox\skin\WebGame\Prompt.bmp
- %APPDATA%\2144GameBox\skin\UserPage\uchoseTab.bmp
- %APPDATA%\2144GameBox\skin\WebGame\WebBG.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnActivate.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnAccount.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnResFullScreen.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnRefresh.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnResMute.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnScreenShot.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnResPause.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnHomeIndex.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnGift.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnKefu.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnRecharge.bmp
- %APPDATA%\2144GameBox\skin\WebGame\btnMute.bmp
- %PROGRAM_FILES%\2144іаФВґ«Лµ\LoginCycs.exe
- %PROGRAM_FILES%\2144іаФВґ«Лµ\LoginCycs.ini
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\2144-іаФВґ«Лµ.lnk
- %APPDATA%\2144GameBox\msvcr100.dll
- %APPDATA%\2144GameBox\msvcp100.dll
- %HOMEPATH%\Start Menu\Programs\2144-іаФВґ«Лµ\Р¶ФШ.lnk
- %HOMEPATH%\Start Menu\Programs\2144-іаФВґ«Лµ\2144-іаФВґ«Лµ.lnk
- %APPDATA%\2144GameBox\mfc100u.dll
- %TEMP%\nso8.tmp\System.dll
- %TEMP%\nsd7.tmp
- %APPDATA%\2144GameBox\skin\btnBossCome.bmp
- %APPDATA%\2144GameBox\GetSerialNum.dll
- %APPDATA%\2144GameBox\skin\btnOption.bmp
- %APPDATA%\2144GameBox\skin\centerBG.bmp
- %APPDATA%\2144GameBox\skin\btnUserLogin.bmp
- %APPDATA%\2144GameBox\GamePlay.exe
- %APPDATA%\2144GameBox\res.dll
- %APPDATA%\2144GameBox\gameUninst.exe
- %APPDATA%\2144GameBox\WebGame.dll
- %APPDATA%\2144GameBox\mfc100.dll
- %TEMP%\nsn2.tmp\nsisdt.dll
- %TEMP%\GetSerialNum.dll
- %TEMP%\nsn2.tmp\inetc.dll
- %TEMP%\nso4.tmp
- %TEMP%\2144GameBox1834_137065.exe
- <SYSTEM32>\2144game_k61324581_137065.exe
- <SYSTEM32>\2144cycs_k61324581_137065.exe
- %TEMP%\2144LoginCycs2001_137065.exe
- %TEMP%\nsn2.tmp\System.dll
- <SYSTEM32>\rengongjubao.txt
- %TEMP%\auth.html
- %APPDATA%\2144GameBox\ImageOle.dll
- %HOMEPATH%\Desktop\2144-іаФВґ«Лµ.lnk
- %PROGRAM_FILES%\2144іаФВґ«Лµ\uninst.exe
- %PROGRAM_FILES%\2144іаФВґ«Лµ\2144LoginCycs_2001.exe
- %APPDATA%\2144GameBox\usedinfo.ini
- %TEMP%\nse5.tmp\FindProcDLL.dll
- %APPDATA%\2144GameBox\BoxUpdata.exe
- %APPDATA%\2144GameBox\gamebox.exe
- %APPDATA%\2144GameBox\FlashGame.dll
- %APPDATA%\2144GameBox\skin\centerClose.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\FlashBG.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\FileDownload.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\FullScreen.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\Pause.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\Mute.bmp
- %APPDATA%\2144GameBox\skin\center_list\item.bmp
- %APPDATA%\2144GameBox\skin\center_list\home.png
- %APPDATA%\2144GameBox\skin\center_list\phone.png
- %APPDATA%\2144GameBox\skin\center_list\webgame.png
- %APPDATA%\2144GameBox\skin\center_list\used.png
- %APPDATA%\2144GameBox\skin\FlashGame\Talk.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\SpeedUp.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\loading.png
- %APPDATA%\2144GameBox\skin\FlashGame\progress_fore.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\progress_back.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\ResMute.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\Replay.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\ResPause.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\SpeedDown.bmp
- %APPDATA%\2144GameBox\skin\FlashGame\ScreenShot.bmp
- %APPDATA%\2144GameBox\skin\game_logo.bmp
- %APPDATA%\2144GameBox\skin\game_line.bmp
- %APPDATA%\2144GameBox\skin\game_user.bmp
- %APPDATA%\2144GameBox\skin\logo.png
- %APPDATA%\2144GameBox\skin\game_xmlBG.bmp
- %APPDATA%\2144GameBox\skin\centerMaxRe.bmp
- %APPDATA%\2144GameBox\skin\centerMax.bmp
- %APPDATA%\2144GameBox\skin\centerMin.bmp
- %APPDATA%\2144GameBox\skin\gameBG.bmp
- %APPDATA%\2144GameBox\skin\centerTop.bmp
- %APPDATA%\2144GameBox\skin\zoom.png
- %APPDATA%\2144GameBox\skin\tabRecom.png
- %APPDATA%\2144GameBox\skin\center_list\download.png
- %APPDATA%\2144GameBox\skin\center_list\flash.png
- %APPDATA%\2144GameBox\skin\center_list\exegame.png
- %APPDATA%\2144GameBox\skin\nointer.png
- %APPDATA%\2144GameBox\skin\lpico.png
- %APPDATA%\2144GameBox\skin\tabBG.bmp
- %APPDATA%\2144GameBox\skin\tabColse.png
- %APPDATA%\2144GameBox\skin\tabBtn.bmp
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\2144game_k61324581_137065.exe
- <SYSTEM32>\2144cycs_k61324581_137065.exe
Deletes the following files:
- %TEMP%\nse5.tmp\inetc.dll
- %TEMP%\nse5.tmp\FindProcDLL.dll
- %HOMEPATH%\Desktop\2144УОП·єРЧУ.lnk
- %TEMP%\2144GameBox1834_137065.exe
- %TEMP%\nse5.tmp\System.dll
- %TEMP%\nse5.tmp\nsisdt.dll
- %TEMP%\nsn2.tmp\nsisdt.dll
- %TEMP%\nsn2.tmp\inetc.dll
- %HOMEPATH%\Desktop\2144-іаФВґ«Лµ.lnk
- %TEMP%\nso8.tmp\System.dll
- %TEMP%\2144LoginCycs2001_137065.exe
- %TEMP%\nsn2.tmp\System.dll
Network activity:
Connects to:
- 'tr####144.2144.cn':80
TCP:
HTTP GET requests:
- tr####144.2144.cn/__box.gif?&a########################################################################################
UDP:
- DNS ASK tr####144.2144.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysDateTimePick32' WindowName: ''
- ClassName: 'SysIPAddress32' WindowName: ''
- ClassName: 'SysTreeView32' WindowName: ''
- ClassName: 'msctls_updown32' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'SysHeader32' WindowName: ''
- ClassName: 'ComboBox' WindowName: ''
- ClassName: 'Edit' WindowName: ''
- ClassName: 'BUTTON' WindowName: ''
- ClassName: 'msctls_trackbar32' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'ListBox' WindowName: ''
- ClassName: 'msctls_progress32' WindowName: ''
