Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\router.exe] 'ImagePath' = '<SYSTEM32>\router.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\router.exe] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\router.exe' = '<SYSTEM32>\router.exe:*:Enabled:Network Rout...
Creates and executes the following:
- '' (downloaded from the Internet)
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies settings of Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<-loopback>'
- [<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:8080;https=127.0.0.1:8080;'
Modifies file system:
Creates the following files:
- C:\Config.Msi\23dae.rbs
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI8.tmp
- <SYSTEM32>\router.exe
- %APPDATA%\Connectify Setup\Connectify Setup 1.0.1\install\disk1.cab
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSI7.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI5.tmp
- <SYSTEM32>\FiddlerCore.dll
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Keys\6B28813A616A3B49F41043B20DF7D25E02B03A21
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\EF7701873C56165FDDE784A1E7D3006CE6C27A86
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\7b90a71bfc56f2582e916a51aed6df9a_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %WINDIR%\Temp\update.exe
- <SYSTEM32>\router.xml
- %TEMP%\nsr11.tmp
- %TEMP%\~DF5481.tmp
- %WINDIR%\Installer\MSIC.tmp
- %TEMP%\ConnectifyInstaller.exe
- <SYSTEM32>\makecert.exe
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSID.tmp
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.back
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\23dab.msi
- %TEMP%\2289c.msi
- %APPDATA%\Connectify Setup\Connectify Setup 1.0.1\install\Connectify Setup.msi
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI1.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %WINDIR%\Installer\23dad.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %TEMP%\~DFB4FF.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
Deletes the following files:
- C:\Config.Msi\23dae.rbs
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSI5.tmp
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.back
- %APPDATA%\Connectify Setup\Connectify Setup 1.0.1\install\Connectify Setup.msi
- %APPDATA%\Connectify Setup\Connectify Setup 1.0.1\install\disk1.cab
- %TEMP%\2289c.msi
- %WINDIR%\Installer\23dab.msi
- %WINDIR%\Installer\23dad.ipi
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI9.tmp
Network activity:
Connects to:
- 'www.se###hly.org':80
- 'wp#d':80
- 'localhost':8080
TCP:
HTTP GET requests:
- http://www.se###hly.org/s/router.xml
- http://www.se###hly.org/s/update.exe
- http://11#.#11.111.1/wpad.dat via wp#d
- http://www.se###hly.org/s/router.xml via localhost
- http://www.se###hly.org/s/update.exe via localhost
UDP:
- DNS ASK www.se###hly.org
- DNS ASK wp#d
Miscellaneous:
Adds a root certificate
Creates and executes the following:
- '%TEMP%\ConnectifyInstaller.exe'
- '%WINDIR%\Temp\update.exe'
- '<SYSTEM32>\router.exe'
- '<SYSTEM32>\makecert.exe' -r -ss my -n "CN=DO_NOT_TRUST_FiddlerRoot, O=DO_NOT_TRUST, OU=Created by http://www.fi###er2.com" -sky signature -eku 1.3.6.1.5.5.7.3.1 -h 1 -cy authority -a sha1 -m 132 -b 12/04/2016
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding E9D4293120E9518174F3DCA1E11827B7
- '<SYSTEM32>\msiexec.exe' -Embedding 5C5651F524B2275E00ADE43589C24203 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' /i "%APPDATA%\Connectify Setup\Connectify Setup 1.0.1\install\Connectify Setup.msi" AI_SETUPEXEPATH=<Full path to file> SETUPEXEDIR=<Current directory>\ EXE_CMD_LINE="/exenoupdates /exelang 0 ...
- '<SYSTEM32>\msiexec.exe' /V
