Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\ahfzfv.lnk
- <SYSTEM32>\tasks\ihfhmf
Modifies file system
Creates the following files
- %TEMP%\aut7db7.tmp
- %TEMP%\wvhoxds
- %TEMP%\skyp\taskhost.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\io94h37p\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\p3088ipb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\9qlao6jg\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\vpv3kipi\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %TEMP%\aut2a3b.tmp
- %TEMP%\alpjtfv
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\io94h37p\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\p3088ipb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\9qlao6jg\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\vpv3kipi\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\aut7db7.tmp
- %TEMP%\wvhoxds
- %TEMP%\aut2a3b.tmp
- %TEMP%\alpjtfv
Network activity
TCP
HTTP GET requests
- http://ip###ore.com/checkip/
UDP
- DNS ASK ip###ore.com
- DNS ASK an#####ys.bounceme.net
Miscellaneous
Creates and executes the following
- '%TEMP%\skyp\taskhost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn "IHFHMF" /tr %TEMP%\Skyp\taskhost.exe /sc minute /mo 1' (with hidden window)
- '%TEMP%\skyp\taskhost.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn "IHFHMF" /tr %TEMP%\Skyp\taskhost.exe /sc minute /mo 1
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "IHFHMF" /tr %TEMP%\Skyp\taskhost.exe /sc minute /mo 1
- '<SYSTEM32>\taskeng.exe' {56A10CF3-300E-43DD-93FD-47DC7016FEFE} S-1-5-21-1960123792-2022915161-3775307078-1001:urjmkhmi\user:Interactive:[1]
