Technical Information
Modifies file system
Creates the following files
- D:\windows\system32\config\software.log1
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\config\system
- D:\windows\system32\config\system.log1
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\winevt\logs\system.evtx
- D:\system volume information\syscache.hve
- D:\system volume information\syscache.hve.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\warning[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\error[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\error[1]
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\caf[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\&meta=1[1].txt
- D:\windows\system32\winevt\logs\application.evtx
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\arrows[1].png
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\82sfsq9d3a5tkc13feo8.temp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\ww3_teamclouds_com[1].txt
- D:\users\user\appdata\local\microsoft\internet explorer\frameiconcache.dat
- D:\users\user\ntuser.dat
- D:\users\user\ntuser.dat.log1
- D:\users\user\appdata\local\temp\~df39490ea5c02661ff.tmp
- D:\users\user\appdata\local\microsoft\internet explorer\recovery\high\active\{810b0c73-dbf9-11ed-aa38-241043c21224}.dat
- D:\users\user\appdata\local\temp\~df43fa5a252faa963a.tmp
- D:\users\user\appdata\local\microsoft\internet explorer\recovery\high\active\{810b0c71-dbf9-11ed-aa38-241043c21224}.dat
- D:\users\user\appdata\local\microsoft\internet explorer\recovery\high\active\recoverystore.{148d03a3-da64-11ed-aa38-241043c21224}.dat
- D:\users\user\appdata\local\temp\~df649ac14b396f912a.tmp
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\px[1].js
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\px[1].js
- D:\windows\system32\config\software
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\caf[1].js
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
Deletes the following files
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\caf[1].js
Moves the following files
- from D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\ww3_teamclouds_com[1].txt to D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\ww3_teamclouds_com[1].htm
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\82sfsq9d3a5tkc13feo8.temp to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\28c8b86deab549a1.customdestinations-ms
Substitutes the following files
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\ww3_teamclouds_com[1].txt
Network activity
Connects to
- 'te###louds.com':80
- 'ww#.##amclouds.com':80
- 'google.com':80
- 'im#.##doparking.com':80
TCP
HTTP GET requests
- http://te###louds.com/px.js?ch##
- http://ww#.##amclouds.com/
- http://www.google.com/adsense/domains/caf.js
- http://im#.##doparking.com/templates/bg/arrows.png
- http://ww#.##amclouds.com/favicon.ico
- http://ww#.##amclouds.com/&meta=1
UDP
- DNS ASK te###louds.com
- DNS ASK ww#.##amclouds.com
- DNS ASK google.com
- DNS ASK im#.##doparking.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
