Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
Modifies file system
Creates the following files
- <Current directory>1.dll
- %WINDIR%\syswow64\espi11.dll
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021062020210621\index.dat
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\[bb6e31560d2271731356293c8feb0fda]
Network activity
Connects to
- 'jq.#q.com':443
- 'cr#.#igicert.cn':80
- 'oc##.#igicert.cn':80
- 'qm.#q.com':80
- 'qm.#q.com':443
- 'p.##ic.cn':443
TCP
HTTP GET requests
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEAalJN882JdPzso5myMS5aM%3D
- http://cr#.#igicert.cn/DigiCertSecureSiteCNCAG3.crl
Other
- 'jq.#q.com':443
- 'qm.#q.com':443
- 'p.##ic.cn':443
UDP
- DNS ASK jq.#q.com
- DNS ASK cr#.#igicert.cn
- DNS ASK oc##.#igicert.cn
- DNS ASK microsoft.com
- DNS ASK qm.#q.com
- DNS ASK p.##ic.cn
- DNS ASK st####.rapidssl.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'TCLSHost.exe'
- ClassName: 'Static' WindowName: ''
- ClassName: '' WindowName: 'CrossSSOHolder.exe'
- ClassName: '' WindowName: 'Tencentdl.exe'
- ClassName: '' WindowName: 'CrossProxy.exe'
- ClassName: '' WindowName: 'TXPlatform.exe'
- ClassName: '' WindowName: 'QTalk.exe'
- ClassName: '' WindowName: 'TPHelper.exe'
- ClassName: '' WindowName: 'bugreport.exe'
- ClassName: '' WindowName: 'bugreport4host.exe'
- ClassName: '' WindowName: 'TenioDL.exe'
- ClassName: '' WindowName: 'Assistant.exe'
- ClassName: '' WindowName: 'TenSafe.exe'
- ClassName: '' WindowName: 'TP3Helper.exe'
- ClassName: '' WindowName: 'AdvertDialog.exe'
- ClassName: '' WindowName: 'BackgroundDownloader.exe'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' https://jq.qq.com/?_wv=1027&k=hEB5MWXx
