Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\At7.job
- %WINDIR%\Tasks\At6.job
- %WINDIR%\Tasks\At9.job
- %WINDIR%\Tasks\At8.job
- %WINDIR%\Tasks\At5.job
- %WINDIR%\Tasks\At2.job
- %WINDIR%\Tasks\At1.job
- %WINDIR%\Tasks\At4.job
- %WINDIR%\Tasks\At3.job
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Creates and executes the following:
- '%TEMP%\golfss.exe' /wrapper /dir="%TEMP%\pkg_1218301f40" /pproc="<Virus name>.exe"
- '%TEMP%\updatems.exe' /n
- '%APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstaller.exe'
- '%TEMP%\golfss.exe'
Executes the following:
- '<SYSTEM32>\at.exe' 13:20 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%PROGRAM_FILES%\Internet Explorer\iexplorer.exe"
- '<SYSTEM32>\at.exe' 22:29 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%CommonProgramFiles%\Microsoft Shared\Speech\sapisvrs.exe"
- '<SYSTEM32>\at.exe' 18:31 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%PROGRAM_FILES%\Movie Maker\moviemks.exe"
- '<SYSTEM32>\at.exe' 18:25 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%TEMP%\updatems.exe"
- '<SYSTEM32>\at.exe' 11:18 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%TEMP%\updatems.exe"
- '<SYSTEM32>\at.exe' 15:22 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%PROGRAM_FILES%\FireFox\update.exe"
- '<SYSTEM32>\reg.exe' add hklm\software\microsoft\windows\currentversion\policies\system /v consentpromptbehavioradmin /t reg_dword /d 0 /f
- '<SYSTEM32>\reg.exe' add hklm\software\microsoft\windows\currentversion\policies\system /v enablelua /t reg_dword /d 0x0 /f
- '<SYSTEM32>\at.exe' 18:24 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstallers.exe"
- '<SYSTEM32>\at.exe' 20:27 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32s.exe"
- '<SYSTEM32>\at.exe' 17:24 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%CommonProgramFiles%\Microsoft Shared\DW\DW20s.exe"
Installs hooks to intercept notifications
on keystrokes:
- Handler for the 'golfss.exe' process: <SYSTEM32>\w1sv32e.dll
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Microsoft Shared\Speech\sapisvrs.exe
- %PROGRAM_FILES%\Internet Explorer\iexplorer.exe
- %PROGRAM_FILES%\FireFox\RCX1.tmp
- %TEMP%\pkg_1218301f40\detectionrules.dat
- %PROGRAM_FILES%\FireFox\update.exe
- <SYSTEM32>\w1sv32e.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\configpublic96[1].dat
- %TEMP%\updatems.exe
- %PROGRAM_FILES%\Internet Explorer\RCX2.tmp
- %PROGRAM_FILES%\Movie Maker\moviemks.exe
- %TEMP%\pkg_1218301f40\wrapper.xml
- %TEMP%\pkg_1218301f40\autorun.txt
- %TEMP%\pkg_1218301f40\stub.log
- %APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstaller.exe
- %TEMP%\golfss.exe
- %CommonProgramFiles%\Microsoft Shared\DW\DW20s.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32s.exe
- %TEMP%\pkg_1218301f40\golfss.log
- %TEMP%\pkg_1218301f40\timings.txt
- %APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstallers.exe
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\configpublic96[1].dat
- %PROGRAM_FILES%\Internet Explorer\iexplorer.exe
- %PROGRAM_FILES%\FireFox\update.exe
Moves the following files:
- from %PROGRAM_FILES%\Internet Explorer\RCX2.tmp to %PROGRAM_FILES%\Internet Explorer\iexplorer.exe
- from %PROGRAM_FILES%\FireFox\RCX1.tmp to %PROGRAM_FILES%\FireFox\update.exe
Network activity:
Connects to:
- 'ma###.#0freehost.com':80
- 'sq####0.tripod.com':80
- 'na#####ammed.tripod.com':80
- 'localhost':1035
- 'dl.###talliq.com':80
TCP:
HTTP GET requests:
- ma###.#0freehost.com/configpublic96.dat
- sq####0.tripod.com/configpublic96.dat
- dl.###talliq.com/api/detectionrequest.aspx?ke####################################
- na#####ammed.tripod.com/configpublic96.dat
UDP:
- DNS ASK ma###.#0freehost.com
- DNS ASK sq####0.tripod.com
- DNS ASK dl.###talliq.com
- DNS ASK na#####ammed.tripod.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'tooltips_class32 ' WindowName: 'MCI command handling window'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
