Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [\REGISTRY\USER\S-1-5-21-1238866942-1249195528-555854008-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1400' = '00000003'
- [\REGISTRY\USER\S-1-5-21-1238866942-1249195528-555854008-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1C00' = '00000000'
Modifies file system
Creates the following files
- D:\windows\system32\config\software.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\roaming\microsoft\uproof\custom.dic
- D:\users\user\appdata\local\microsoft\office\onetconfig\998bcf2d84167c3ecb6ea5f94ac47905.sig
- D:\users\user\appdata\local\microsoft\office\onetconfig\998bcf2d84167c3ecb6ea5f94ac47905.xml
- D:\users\user\appdata\roaming\microsoft\uproof\excludedictionaryen0409.lex
- D:\system volume information\syscache.hve.log1
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
- D:\system volume information\syscache.hve
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\config\system.log1
- D:\windows\system32\config\system
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
- D:\windows\system32\winevt\logs\application.evtx
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt
- D:\users\user\appdata\roaming\microsoft\office\recent\<File name>.lnk
- D:\users\user\appdata\roaming\microsoft\office\recent\index.dat
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.word\~wrs{f3dc5e6c-1651-4ffa-9e32-c10dac2d34bd}.tmp
- D:\users\public\~$ttrcia.docx
- D:\programdata\microsoft\search\data\applications\windows\mss.log
- D:\programdata\cache2.exe
- D:\users\public\<File name>.docx
- D:\windows\appcompat\programs\recentfilecache.bcf
- D:\windows\system32\tasks\wxtaskdrvss
- D:\users\user\appdata\local\temp\cabd0d5.tmp
- D:\users\user\ntuser.dat.log1
- D:\users\user\appdata\local\temp\tard0d6.tmp
- D:\programdata\microsoft\officesoftwareprotectionplatform\cache\cache.dat
- D:\windows\system32\winevt\logs\system.evtx
- D:\users\user\ntuser.dat
- D:\users\user\appdata\local\temp\tard432.tmp
- D:\users\user\appdata\local\temp\cabd4c0.tmp
- D:\users\user\appdata\local\temp\tard4c1.tmp
- D:\users\user\appdata\local\temp\cabd5fa.tmp
- D:\users\user\appdata\local\temp\tard60a.tmp
- D:\programdata\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000
- D:\users\user\appdata\roaming\microsoft\office\mso1033.acl
- D:\windows\system32\config\software
- D:\users\user\appdata\local\temp\cabd431.tmp
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
Sets the 'hidden' attribute to the following files
- D:\users\user\appdata\roaming\microsoft\office\recent\index.dat
Deletes the following files
- D:\users\user\appdata\local\temp\cabd0d5.tmp
- D:\users\user\appdata\local\temp\tard0d6.tmp
- D:\users\user\appdata\local\temp\cabd431.tmp
- D:\users\user\appdata\local\temp\tard432.tmp
- D:\users\user\appdata\local\temp\cabd4c0.tmp
- D:\users\user\appdata\local\temp\tard4c1.tmp
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\users\user\appdata\local\temp\cabd5fa.tmp
- D:\users\user\appdata\local\temp\tard60a.tmp
- D:\users\user\appdata\roaming\microsoft\office\recent\<File name>.lnk
- D:\users\user\appdata\local\microsoft\office\onetconfig\998bcf2d84167c3ecb6ea5f94ac47905.xml
- D:\users\user\appdata\local\microsoft\office\onetconfig\998bcf2d84167c3ecb6ea5f94ac47905.sig
Substitutes the following files
- D:\users\user\appdata\roaming\microsoft\office\recent\<File name>.lnk
- D:\users\user\appdata\local\microsoft\office\onetconfig\998bcf2d84167c3ecb6ea5f94ac47905.sig
- D:\users\user\appdata\local\microsoft\office\onetconfig\998bcf2d84167c3ecb6ea5f94ac47905.xml
Network activity
Connects to
- 'he###########izzionhf.cn-zhangjiakou.fcapp.run':443
- 'office14client.microsoft.com':80
TCP
HTTP GET requests
- http://office14client.microsoft.com/config14?UI########################################################################################################
Other
- 'localhost':49158
- 'he###########izzionhf.cn-zhangjiakou.fcapp.run':443
- '34.##0.144.191':443
- '34.##1.73.144':443
UDP
- DNS ASK he###########izzionhf.cn-zhangjiakou.fcapp.run
- DNS ASK office14client.microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'mspim_wnd32' WindowName: ''
- ClassName: 'MSOBALLOON' WindowName: ''
- ClassName: 'MsoHelp10' WindowName: ''
- ClassName: 'AgentAnim' WindowName: ''
- ClassName: 'NetUICtrlNotifySink' WindowName: ''
- ClassName: 'REListbox20W' WindowName: ''
- ClassName: 'OfficeTooltip' WindowName: ''
- ClassName: 'MsoCommandBarPopup' WindowName: ''
Creates and executes the following
- 'D:\programdata\cache2.exe'
