Technical Information
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\glbaa33.tmp
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\notifications.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\md5.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\mainsingleton.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\log.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\io.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\http.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\externallibraryloader.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\ebencryption.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\datastructures.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\chat.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\install.rdf
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\defaults\unsharedappscontextmenu.xml
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\defaults\toolbarcontextmenu.xml
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\defaults\postappscontextmenu.xml
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\defaults\getappscontextmenu.xml
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\defaults\fbalert.js
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\defaults\appcontextmenu.xml
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\defaults\alertsettingscomponent.xml
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\components\radiowmpcoregecko9.dll
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\components\radiowmpcoregecko8.dll
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\components\radiowmpcoregecko7.dll
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\observersandevents.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\searchprotector.jsm
- %TEMP%\nsc2d0a.tmp
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\searchsuggestio.jsm
- %TEMP%\nsx2bb2.tmp\processes.dll
- %TEMP%\ccis\ccsqlh.exe
- %TEMP%\ccis\sqlite3.dll
- %TEMP%\ct3072194\manifest.json
- %TEMP%\ct3072194\ct3072194.txt
- %TEMP%\nsx2bb2.tmp\zipdll.dll
- %TEMP%\ccex.crx
- %TEMP%\nsx2bb2.tmp\system.dll
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\setup.ini
- %TEMP%\nsc26a4.tmp
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\meta-inf\zigbert.sf
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\meta-inf\manifest.mf
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\version.txt
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\searchplugin\conduit.xml
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\xml.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\windows.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\url.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\twitter.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\timer.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\teaencryption.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\string.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\components\radiowmpcoregecko6.dll
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\modules\prefs.jsm
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\components\radiowmpcoregecko5.dll
- %TEMP%\nsccaee.tmp.tbwall.dll
- %TEMP%\nshcabe.tmp\system.dll
- %TEMP%\nshcabe.tmp\home_icon.bmp
- %TEMP%\nshcabe.tmp\search_icon.bmp
- %TEMP%\nshcabe.tmp\truste_setup.bmp
- %TEMP%\nshcabe.tmp\alerts_icon.bmp
- %TEMP%\nshcabe.tmp\setup_top.bmp
- %TEMP%\nshcabe.tmp\publisherlogodefault.bmp
- %TEMP%\nsxc8fa.tmp\nsexec.dll
- %TEMP%\nsxc8fa.tmp\conduitinetc.dll
- %TEMP%\nsxc8fa.tmp\system.dll
- %TEMP%\nsxc726.tmp\nsexec.dll
- %TEMP%\conduitinstaller.exe
- %TEMP%\ct3072194\~glbs383.tmp
- %TEMP%\ct3072194\~glh0004.tmp
- %TEMP%\ct3072194\~glh0003.tmp
- %TEMP%\ct3072194\~glh0002.tmp
- %TEMP%\ct3072194\~glh0001.tmp
- %TEMP%\~glh0000.tmp
- %TEMP%\glgb109.tmp
- %TEMP%\glkacb4.tmp
- %TEMP%\glcac65.tmp
- %TEMP%\nshcabe.tmp\license.txt
- %ProgramFiles(x86)%\walla_kids\toolbar.cfg
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\components\radiowmpcore.xpt
- %ProgramFiles(x86)%\walla_kids\walla_kidstoolbarhelper.exe
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\components\conduitautocompletesearch.xpt
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\components\conduitautocompletesearch.js
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\chrome\walla_kids.jar
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\meta-inf\zigbert.rsa
- %TEMP%\ct3072194\xpi\install.rdf
- %TEMP%\nsx23c6.tmp\zipdll.dll
- %TEMP%\ct3072194\ct3072194.xpi
- %ProgramFiles(x86)%\conduit\community alerts\alert.dll
- %LOCALAPPDATA%low\walla_kids\toolbar.cfg
- %LOCALAPPDATA%low\walla_kids\ldrtbwall.dll
- %LOCALAPPDATA%low\walla_kids\tbwall.dll
- %ProgramFiles(x86)%\walla_kids\uninstall.exe
- %ProgramFiles(x86)%\walla_kids\toolbarcontextmenu.xml
- %ProgramFiles(x86)%\walla_kids\sharedappscontextmenu.xml
- %ProgramFiles(x86)%\walla_kids\otherappscontextmenu.xml
- %ProgramFiles(x86)%\walla_kids\gottenappscontextmenu.xml
- %ProgramFiles(x86)%\walla_kids\ldrtbwall.dll
- %ProgramFiles(x86)%\walla_kids\prxtbwall.dll
- %ProgramFiles(x86)%\walla_kids\tbwall.dll
- %LOCALAPPDATA%\conduit\ct3072194\walla_kidsautoupdatehelper.exe
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\extensions\{e1eaf689-9c43-4d19-b7c4-b2f4215b7ad5}\components\radiowmpcoregecko19.dll
- %TEMP%\nsx2bb2.tmp\nsexec.dll
Deletes the following files
- %TEMP%\ct3072194\parameters.csf
- %TEMP%\glkacb4.tmp
- %TEMP%\glgb109.tmp
- %TEMP%\ct3072194\stubwrapper.exe
- %TEMP%\ct3072194\ct3072194_ch.exe
- %TEMP%\ct3072194\ct3072194_ff.exe
- %TEMP%\ct3072194\ct3072194_ie.exe
- %TEMP%\nsxc726.tmp\nsexec.dll
- %TEMP%\nsxc8fa.tmp\system.dll
- %TEMP%\nsxc8fa.tmp\nsexec.dll
- %TEMP%\nsxc8fa.tmp\conduitinetc.dll
- %TEMP%\nsx2bb2.tmp\zipdll.dll
- %TEMP%\glcac65.tmp
- %TEMP%\nsx2bb2.tmp\system.dll
- %TEMP%\nsx2bb2.tmp\nsexec.dll
- %TEMP%\nsx23c6.tmp\zipdll.dll
- %TEMP%\nshcabe.tmp\truste_setup.bmp
- %TEMP%\nshcabe.tmp\system.dll
- %TEMP%\nshcabe.tmp\setup_top.bmp
- %TEMP%\nshcabe.tmp\search_icon.bmp
- %TEMP%\nshcabe.tmp\publisherlogodefault.bmp
- %TEMP%\nshcabe.tmp\license.txt
- %TEMP%\nshcabe.tmp\home_icon.bmp
- %TEMP%\nshcabe.tmp\alerts_icon.bmp
- %TEMP%\nsccaee.tmp.tbwall.dll
- %TEMP%\nsx2bb2.tmp\processes.dll
- %TEMP%\glbaa33.tmp
Moves the following files
- from %TEMP%\~glh0000.tmp to %TEMP%\ct3072194_ie.exe
- from %TEMP%\ct3072194\~glh0001.tmp to %TEMP%\ct3072194\ct3072194_ie.exe
- from %TEMP%\ct3072194\~glh0002.tmp to %TEMP%\ct3072194\ct3072194_ff.exe
- from %TEMP%\ct3072194\~glh0003.tmp to %TEMP%\ct3072194\ct3072194_ch.exe
- from %TEMP%\ct3072194\~glh0004.tmp to %TEMP%\ct3072194\stubwrapper.exe
- from %TEMP%\ct3072194\~glbs383.tmp to %TEMP%\ct3072194\parameters.csf
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
Substitutes the following files
- %TEMP%\ct3072194\~glbs383.tmp
- %TEMP%\ct3072194\parameters.csf
- %TEMP%\ct3072194\conduitstatistics.csf
Network activity
Connects to
- 'se#######p.conduit-services.com':80
- 'us###.####bar.conduit-services.com':80
- 'st####e.conduit.com':80
- 'us###.#######tion.toolbar.conduit-services.com':80
UDP
- DNS ASK se#######p.conduit-services.com
- DNS ASK us###.####bar.conduit-services.com
- DNS ASK st####e.conduit.com
- DNS ASK us###.#######tion.toolbar.conduit-services.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%TEMP%\glbaa33.tmp' 4736 <Full path to file>
- '%TEMP%\conduitinstaller.exe' -StartPage=TRUE -DefaultSearch=TRUE -SearchFromAddress=TRUE -InstallId=CT3072194_walla_kids.exe -OpenUninstallPage=TRUE -Fix404=TRUE -EnableAlerts=TRUE -showPersonalCompDialog=FALSE -ctid=CT307...
- '%TEMP%\ct3072194\ct3072194_ie.exe' /s -silent -startpage=true -defaultsearch=true -showwelcomepage=false -openwelcomedialog=false -showpersonalcompdialog=false -fix404=true -searchfromaddress=true -searchfromadress=true -openuni...
- '%TEMP%\ct3072194\ct3072194_ff.exe' /s -silent -startpage=true -defaultsearch=true -showwelcomepage=false -openwelcomedialog=false -showpersonalcompdialog=false -fix404=true -searchfromaddress=true -searchfromadress=true -openuni...
- '%TEMP%\ct3072194\ct3072194_ch.exe' /s -silent -startpage=true -defaultsearch=true -showwelcomepage=false -openwelcomedialog=false -showpersonalcompdialog=false -fix404=true -searchfromaddress=true -searchfromadress=true -openuni...
- '%TEMP%\ccis\ccsqlh.exe' CT3072194
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\walla_kids\tbwall.dll" DllSendInstallationUsage New Installation
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\walla_kids\tbwall.dll" DllVerifyEnableExtension
- '%TEMP%\ct3072194_ie.exe\stubwr~1.exe' -parameters=%TEMP%\CT3072194\parameters.csf' (with hidden window)
- '%TEMP%\conduitinstaller.exe' -StartPage=TRUE -DefaultSearch=TRUE -SearchFromAddress=TRUE -InstallId=CT3072194_walla_kids.exe -OpenUninstallPage=TRUE -Fix404=TRUE -EnableAlerts=TRUE -showPersonalCompDialog=FALSE -ctid=CT307...' (with hidden window)
- '%TEMP%\ct3072194\ct3072194_ie.exe' /s -silent -startpage=true -defaultsearch=true -showwelcomepage=false -openwelcomedialog=false -showpersonalcompdialog=false -fix404=true -searchfromaddress=true -searchfromadress=true -openuni...' (with hidden window)
- '%TEMP%\ct3072194\ct3072194_ff.exe' /s -silent -startpage=true -defaultsearch=true -showwelcomepage=false -openwelcomedialog=false -showpersonalcompdialog=false -fix404=true -searchfromaddress=true -searchfromadress=true -openuni...' (with hidden window)
- '%TEMP%\ct3072194\ct3072194_ch.exe' /s -silent -startpage=true -defaultsearch=true -showwelcomepage=false -openwelcomedialog=false -showpersonalcompdialog=false -fix404=true -searchfromaddress=true -searchfromadress=true -openuni...' (with hidden window)
- '%TEMP%\ccis\ccsqlh.exe' CT3072194' (with hidden window)
