Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\microsoft\windows\currentversion\run] 'Java_Updater' = '%APPDATA%\MS WM Player\msplayer.exe'
- [<HKCU>\SOFTWARE\microsoft\windows NT\currentversion\windows] 'load' = '%APPDATA%\MS WM Player\msplayer.exe'
- [<HKCU>\SOFTWARE\microsoft\windows\currentversion\Policies\explorer\run] 'Flash_Updater' = '%APPDATA%\MS WM Player\msplayer.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\microsoft\windows\currentversion\Policies\explorer\run] 'Flash_Updater' = '%APPDATA%\MS WM Player\msplayer.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\microsoft\Active Setup\Installed Components\{CUJ8I3HK-1556-JUJX-8524-BT0P88A84421}] 'StubPath' = '%APPDATA%\MS WM Player\msplayer.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\microsoft\windows\currentversion\run] 'Java_Updater' = '%APPDATA%\MS WM Player\msplayer.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\microsoft\windows NT\currentversion\winlogon] 'userinit' = 'userinit.exe,%APPDATA%\MS WM Player\msplayer.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\office toolbar.lnk
- <SYSTEM32>\tasks\ms_cleanup
- <SYSTEM32>\tasks\ms_diskcleanup
Modifies file system
Creates the following files
- %APPDATA%\ms wm player\msplayer.exe
- %APPDATA%\ms wm player\torclient\tordata\cached-certs.tmp
- %APPDATA%\ms wm player\torclient\tordata\unverified-microdesc-consensus.tmp
- %APPDATA%\ms wm player\torclient\tor.pid
- %APPDATA%\ms wm player\torclient\tordata\state.tmp
- %APPDATA%\ms wm player\torclient\torconfig
- %APPDATA%\ms wm player\torclient\libssp-0.dll
- %TEMP%\aut66a4.tmp
- %APPDATA%\ms wm player\torclient\zlib1.dll
- %TEMP%\aut6655.tmp
- %APPDATA%\ms wm player\torclient\tordata\cached-microdesc-consensus.tmp
- %APPDATA%\ms wm player\torclient\ssleay32.dll
- %APPDATA%\ms wm player\torclient\libgcc_s_sjlj-1.dll
- %TEMP%\aut651b.tmp
- %APPDATA%\ms wm player\torclient\libevent-2-0-5.dll
- %TEMP%\aut64cc.tmp
- %APPDATA%\ms wm player\torclient\libeay32.dll
- %TEMP%\aut62f7.tmp
- %APPDATA%\ms wm player\torclient\svchost.exe
- %TEMP%\aut620c.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\officetoolbar.lnk
- %TEMP%\aut658a.tmp
- %APPDATA%\ms wm player\torclient\tordata\cached-microdescs.new
Deletes the following files
- %TEMP%\aut620c.tmp
- %TEMP%\aut62f7.tmp
- %TEMP%\aut64cc.tmp
- %TEMP%\aut651b.tmp
- %TEMP%\aut658a.tmp
- %TEMP%\aut6655.tmp
- %TEMP%\aut66a4.tmp
- %APPDATA%\ms wm player\torclient\tordata\unverified-microdesc-consensus
- %APPDATA%\ms wm player\torclient\tordata\state
Moves the following files
- from %APPDATA%\ms wm player\torclient\tordata\state.tmp to %APPDATA%\ms wm player\torclient\tordata\state
- from %APPDATA%\ms wm player\torclient\tordata\unverified-microdesc-consensus.tmp to %APPDATA%\ms wm player\torclient\tordata\unverified-microdesc-consensus
- from %APPDATA%\ms wm player\torclient\tordata\cached-certs.tmp to %APPDATA%\ms wm player\torclient\tordata\cached-certs
- from %APPDATA%\ms wm player\torclient\tordata\cached-microdesc-consensus.tmp to %APPDATA%\ms wm player\torclient\tordata\cached-microdesc-consensus
Substitutes the following files
- %APPDATA%\ms wm player\torclient\tordata\state.tmp
- %APPDATA%\ms wm player\torclient\tordata\state
Network activity
TCP
- 'localhost':9050
- '13#.#88.40.189':443
- '51.##.136.241':9001
- '12#.#08.2.233':9001
- '11#.#02.155.223':443
UDP
- DNS ASK stun.l.google.com
- 'stun.l.google.com':19302
Miscellaneous
Creates and executes the following
- '%APPDATA%\ms wm player\msplayer.exe'
- '%APPDATA%\ms wm player\torclient\svchost.exe' -f TorConfig
