Trojan.Click1.44429

Technical Information

Malicious functions:

Creates and executes the following:

C:\J8E2R8.exe

Executes the following:

<SYSTEM32>\cacls.exe "<Full path to virus>" /e /c /r %USERNAME%s
<SYSTEM32>\cacls.exe "<Full path to virus>" /e /c /G Everyone:r
<SYSTEM32>\cacls.exe "%PROGRAM_FILES%\ttb.ico" /e /c /r "Power Users"
<SYSTEM32>\cacls.exe "<Full path to virus>" /e /c /r "%USERNAME%
<SYSTEM32>\cacls.exe "<Full path to virus>" /e /c /r Users
<SYSTEM32>\cacls.exe "<Full path to virus>" /e /c /r System
<SYSTEM32>\cacls.exe "%PROGRAM_FILES%\ttb.ico" /e /c /r "Authenticated Users"
<SYSTEM32>\cacls.exe "%PROGRAM_FILES%\ttb.ico" /e /c /r %USERNAME%s
<SYSTEM32>\cacls.exe "%PROGRAM_FILES%\ttb.ico" /e /c /G Everyone:r
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\购物淘宝.lnk" /e /c /r "Power Users"
<SYSTEM32>\cacls.exe "%PROGRAM_FILES%\ttb.ico" /e /c /r "%USERNAME%
<SYSTEM32>\cacls.exe "%PROGRAM_FILES%\ttb.ico" /e /c /r Users
<SYSTEM32>\cacls.exe "%PROGRAM_FILES%\ttb.ico" /e /c /r System
<SYSTEM32>\cacls.exe "<Full path to virus>" /e /c /r "Authenticated Users"
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://dl.###link.cn:1287/CPAdown/Loader_jieku_977.html
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.ba##u.com/
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Intrenet Expolrer.lnk" /e /c /r "Power Users"
<SYSTEM32>\wscript.exe del.tmp.vbs
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://dl.###link.cn:1287/CPAdown/vplay.html
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://dl.###link.cn:1287/CPAdown/haozip_tiny.200629.html
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Intrenet Expolrer.lnk" /e /c /r "Authenticated Users"
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Intrenet Expolrer.lnk" /e /c /r %USERNAME%s
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Intrenet Expolrer.lnk" /e /c /G Everyone:r
<SYSTEM32>\cacls.exe "<Full path to virus>" /e /c /r "Power Users"
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Intrenet Expolrer.lnk" /e /c /r "%USERNAME%
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Intrenet Expolrer.lnk" /e /c /r Users
<SYSTEM32>\cacls.exe "%HOMEPATH%\Desktop\Intrenet Expolrer.lnk" /e /c /r System
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\购物淘宝.lnk" /e /c /r "Authenticated Users"
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\上网指南.lnk" /e /c /r %USERNAME%s
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\上网指南.lnk" /e /c /G Everyone:r
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\Intrenet Expolrer.lnk" /e /c /r "Power Users"
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\上网指南.lnk" /e /c /r "%USERNAME%
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\上网指南.lnk" /e /c /r Users
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\上网指南.lnk" /e /c /r System
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\Intrenet Expolrer.lnk" /e /c /r "Authenticated Users"
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\Intrenet Expolrer.lnk" /e /c /r %USERNAME%s
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\Intrenet Expolrer.lnk" /e /c /G Everyone:r
<SYSTEM32>\ipconfig.exe /all
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\Intrenet Expolrer.lnk" /e /c /r "%USERNAME%
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\Intrenet Expolrer.lnk" /e /c /r Users
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\Intrenet Expolrer.lnk" /e /c /r System
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\上网指南.lnk" /e /c /r "Authenticated Users"
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\购物淘宝.lnk" /e /c /r %USERNAME%s
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\购物淘宝.lnk" /e /c /G Everyone:r
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\精彩小游戏.lnk" /e /c /r "Power Users"
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\购物淘宝.lnk" /e /c /r "%USERNAME%
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\购物淘宝.lnk" /e /c /r Users
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\购物淘宝.lnk" /e /c /r System
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\精彩小游戏.lnk" /e /c /r "Authenticated Users"
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\精彩小游戏.lnk" /e /c /r %USERNAME%s
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\精彩小游戏.lnk" /e /c /G Everyone:r
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\上网指南.lnk" /e /c /r "Power Users"
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\精彩小游戏.lnk" /e /c /r "%USERNAME%
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\精彩小游戏.lnk" /e /c /r Users
<SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\Desktop\精彩小游戏.lnk" /e /c /r System

Modifies file system :

Creates the following files:

C:\J8E2R8.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\baidu[1]
<Current directory>\del.tmp.vbs
%ALLUSERSPROFILE%\Start Menu\iiee.lnk
%PROGRAM_FILES%\ttb.ico
%WINDIR%\Temp\dn_9e.tmp
%ALLUSERSPROFILE%\Start Menu\iiieee.lnk

Sets the 'hidden' attribute to the following files:

C:\J8E2R8.exe
%ALLUSERSPROFILE%\Desktop\Intrenet Expolrer.lnk
%PROGRAM_FILES%\ttb.ico

Deletes the following files:

<Current directory>\del.tmp.vbs
%WINDIR%\Temp\dn_9e.tmp

Deletes itself.

Network activity:

Connects to:

'dl.##nlink.cn':1287
'localhost':1042
'localhost':1044
'localhost':1037
'www.ba##u.com':80
'localhost':1040

TCP:

HTTP GET requests:

www.ba##u.com/

UDP:

DNS ASK dl.##nlink.cn
DNS ASK www.ba##u.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Progman' WindowName: ''
ClassName: 'SHELLDLL_DefView' WindowName: ''
ClassName: 'SysListView32' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial