Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\PzuService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\PzuService] 'ImagePath' = '"%APPDATA%\Pzu\PzuSvr.exe" -r'
Creates the following services
- 'PzuService' "%APPDATA%\Pzu\PzuSvr.exe" -r
Modifies file system
Creates the following files
- %TEMP%\kupg_res_101563.tmp\upgrademini.exe.cfg
- %APPDATA%\pzudata\kminiskin\btn_min.png
- %APPDATA%\pzudata\kminiskin\btn_lnk.png
- %APPDATA%\pzudata\kminiskin\btn_close_1.png
- %APPDATA%\pzudata\kminiskin\btn_close.png
- %APPDATA%\pzu\userconfig.dat
- %APPDATA%\pzu\userconfig.ini
- %TEMP%\_res.tmp\sysbrw.exe
- %TEMP%\_res.tmp\pzusvr.exe
- %TEMP%\_res.tmp\kminipage.exe
- %TEMP%\_res.tmp\kflashtray.exe
- %TEMP%\_res.tmp\kadhelper.exe
- %TEMP%\_res.tmp\kminiskin\minipage.ico
- %TEMP%\_res.tmp\kminiskin\window.png
- %TEMP%\_res.tmp\kminiskin\btn_min.png
- %TEMP%\_res.tmp\kminiskin\btn_lnk.png
- %TEMP%\_res.tmp\kminiskin\btn_close_1.png
- %TEMP%\_res.tmp\kminiskin\btn_close.png
- %TEMP%\res_10516a.7z
- %TEMP%\kupg_res_101563.tmp\upgrademini.exe.tda
- %APPDATA%\pzudata\kminiskin\minipage.ico
- %APPDATA%\pzudata\kminiskin\window.png
Deletes the following files
- %TEMP%\kupg_res_101563.tmp\upgrademini.exe.cfg
- %TEMP%\res_10516a.7z
- %APPDATA%\pzu\userconfig.ini
- %TEMP%\_res.tmp\kminiskin\btn_close.png
- %TEMP%\_res.tmp\kminiskin\btn_close_1.png
- %TEMP%\_res.tmp\kminiskin\btn_lnk.png
- %TEMP%\_res.tmp\kminiskin\btn_min.png
- %TEMP%\_res.tmp\kminiskin\minipage.ico
- %TEMP%\_res.tmp\kminiskin\window.png
Moves the following files
- from %TEMP%\kupg_res_101563.tmp\upgrademini.exe.tda to %TEMP%\kupg_res_101563.tmp\upgrademini.exe
- from %TEMP%\_res.tmp\kminipage.exe to %APPDATA%\pzudata\kminipage.exe
- from %TEMP%\_res.tmp\kflashtray.exe to %APPDATA%\pzudata\kflashtray.exe
- from %TEMP%\_res.tmp\sysbrw.exe to %APPDATA%\pzudata\sysbrw.exe
- from %TEMP%\_res.tmp\kadhelper.exe to %APPDATA%\pzudata\kadhelper.exe
- from %TEMP%\_res.tmp\pzusvr.exe to %APPDATA%\pzu\pzusvr.exe
Network activity
TCP
HTTP GET requests
- http://ap#.#ynrl.cn/cfg/upgrade/upglist.json
- http://dl.#o02.com/upg/upgradeMini.exe
- http://ap#.#8ugo.com/index.php?m=############################################################################################
UDP
- DNS ASK ap#.#ynrl.cn
- DNS ASK dl.#o02.com
- DNS ASK ap#.#8ugo.com
Miscellaneous
Searches for the following windows
- ClassName: 'LogView_qqpcmgr' WindowName: ''
Creates and executes the following
- '%TEMP%\kupg_res_101563.tmp\upgrademini.exe' /opt=start
- '%APPDATA%\pzu\pzusvr.exe' -i
- '%APPDATA%\pzu\pzusvr.exe' -r
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\kupg_res_101563.tmp\upgradeMini.exe" /opt=start' (with hidden window)
- '%APPDATA%\pzu\pzusvr.exe' -i' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\kupg_res_101563.tmp\upgradeMini.exe" /opt=start
