Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '%ProgramFiles%\rundll32.exe C:\PROGRA~3\ljmhi.dat,FG00'
Creates or modifies the following files
- %APPDATA%\Microsoft\windows\Start Menu\programs\startup\msconfig.lnk
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2500' = '00000003'
Modifies file system
Creates the following files
- %ProgramFiles%\rundll32.exe
- %ProgramFiles%\ljmhi.dat
- %ProgramFiles%\ihmjl.pad
- %ProgramFiles%\ihmjl.js
- %ProgramFiles%\ihmjl.bat
- %ProgramFiles%\ihmjl.reg
Network activity
Connects to
- '37.##9.53.102':80
- '66.##7.215.165':443
- 'wh###illber.com':443
- '37.##9.53.102':443
TCP
Other
- 'wh###illber.com':443
UDP
- DNS ASK wh###illber.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG00
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG01
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG02
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG03
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG06
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG04
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG00' (with hidden window)
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG01' (with hidden window)
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG02' (with hidden window)
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG03' (with hidden window)
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG06' (with hidden window)
- '%ProgramFiles%\rundll32.exe' C:\PROGRA~3\ljmhi.dat,FG04' (with hidden window)
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
- '%WINDIR%\syswow64\ctfmon.exe'
