Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{D7721A38-ABCD-3586-DCAB-40E2A90F3738}] 'Exec' = 'https://secureaccess.rjf.com'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "C:\CSS\fonts1.vbs"
- '<SYSTEM32>\wscript.exe' "C:\rjcerts\cer.vbs"
- '<SYSTEM32>\wscript.exe' "C:\CSS\fonts.vbs"
Executes the following:
- 'C:\rjcerts\CertMgr.exe' -add C:\rjcerts\RJ_Root.cer -s -r localMachine ROOT
- '<SYSTEM32>\cmd.exe' /c C:\rjcerts\CertMgr.Exe -add C:\rjcerts\RJ_Root.cer -s -r localMachine ROOT
- '%WINDIR%\regedit.exe' /s DefaultUser.reg
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\msflxgrd.ocx
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\MSSTDFMT.DLL
- '%ProgramFiles%\aainst\certs.exe'
- '%ProgramFiles%\aainst\trusted.exe'
- '%WINDIR%\regedit.exe' /s CurrentUser.reg
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -Embedding
- '%ProgramFiles%\aainst\fontinstall.exe'
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A04' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1A00' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2000' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2007' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1806' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '160A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1608' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1800' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1804' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1803' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1802' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2100' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2401' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2301' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2402' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2600' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2103' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2102' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2101' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2104' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2105' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'PMDisplayName' = 'Trusted sites [Protected Mode]'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'MinLevel' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'LowIcon' = 'inetcpl.cpl#005424'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'RecommendedLevel' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Icon' = 'inetcpl.cpl#00004480'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2007' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'DisplayName' = 'Trusted sites'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Description' = 'This zone contains web sites that you trust not to damage your computer or your files'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'CurrentLevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1409' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1407' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1601' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1607' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1606' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1604' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1402' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '120B' = '00000000'
Modifies file system:
Creates the following files:
- %TEMP%\aut16.tmp
- C:\rjcerts\RJFRoot.cer
- C:\CSS\idauc128l.ttf
- C:\rjcerts\RJFInt6.cer
- %TEMP%\aut18.tmp
- C:\rjcerts\RJ_Inter2_export.cer
- %TEMP%\aut17.tmp
- C:\rjcerts\RJ_Inter1_export.cer
- %TEMP%\aut15.tmp
- C:\rjcerts\RJFInt3.cer
- %TEMP%\aut12.tmp
- C:\CSS\carolinabar3of9.ttf
- %TEMP%\aut11.tmp
- C:\rjcerts\RJFInt5.cer
- %TEMP%\aut14.tmp
- C:\CSS\carolinabold.ttf
- %TEMP%\aut13.tmp
- %TEMP%\aut19.tmp
- <SYSTEM32>\MSSTDFMT.DLL
- %TEMP%\aut1F.tmp
- %TEMP%\aut1D.tmp
- %TEMP%\aut1E.tmp
- C:\CSS\fonts1.vbs
- %WINDIR%\Fonts\3-of-9-barcode.ttf
- <SYSTEM32>\MSFlxGrd.ocx
- %TEMP%\aut20.tmp
- %WINDIR%\Fonts\carolinabar3of9.ttf
- C:\CSS\fonts.vbs
- %TEMP%\aut1B.tmp
- C:\rjcerts\RJ_Root_export.cer
- %TEMP%\aut1A.tmp
- C:\rjcerts\cer.vbs
- %WINDIR%\Fonts\carolinabold.ttf
- C:\rjcerts\CertMgr.exe
- %TEMP%\aut1C.tmp
- %HOMEPATH%\Favorites\RJ IT\RJ Gateway.url
- %HOMEPATH%\Favorites\RJ IT\RJ Secure Access.url
- %HOMEPATH%\Favorites\RJ IT\Password Assistance.url
- %HOMEPATH%\Favorites\RJ IT\Technology Service Center.url
- %HOMEPATH%\Favorites\RJ IT\Technology News.url
- %TEMP%\aut6.tmp
- %HOMEPATH%\Favorites\RJ IT\RJ Trusted patch.url
- %HOMEPATH%\Favorites\RJ IT\Technology Education and Suggestions.url
- %TEMP%\aut5.tmp
- %TEMP%\aut2.tmp
- %ProgramFiles%\aainst\fontinstall.exe
- %TEMP%\aut1.tmp
- %ProgramFiles%\aainst\certs.exe
- %TEMP%\aut4.tmp
- %ProgramFiles%\aainst\trusted.exe
- %TEMP%\aut3.tmp
- %ProgramFiles%\aainst\dotnetfour.exe
- %TEMP%\aut7.tmp
- C:\rjcerts\RJFInt1.cer
- %TEMP%\autE.tmp
- C:\CSS\3-of-9-barcode.ttf
- %TEMP%\autD.tmp
- C:\rjcerts\RJFInt2.cer
- %TEMP%\aut10.tmp
- C:\CSS\barcode.exe
- %TEMP%\autF.tmp
- %TEMP%\autC.tmp
- %TEMP%\aut9.tmp
- C:\rjcerts\RJF_CA6.cer
- %TEMP%\aut8.tmp
- C:\rjcerts\RJ_CA7.cer
- %TEMP%\autB.tmp
- C:\rjcerts\RJF_Root.cer
- %TEMP%\autA.tmp
- C:\rjcerts\RJ_Root.cer
Deletes the following files:
- %TEMP%\aut16.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut1D.tmp
- %TEMP%\aut20.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut19.tmp
- %TEMP%\aut1C.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut3.tmp
- %TEMP%\autE.tmp
- %TEMP%\autD.tmp
- %TEMP%\aut10.tmp
- %TEMP%\autF.tmp
- %TEMP%\autA.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autC.tmp
- %TEMP%\autB.tmp
Network activity:
Connects to:
- 'localhost':1037
Miscellaneous:
Adds a root certificate
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
