Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run_Once] 'Update' = 'C:\Users\NICKY\AppData\Local\Temp\run.bat'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Update' = 'C:\Users\NICKY\AppData\Local\Temp\run.bat'
Malicious functions:
Creates and executes the following:
- '%TEMP%\Up.exe'
Modifies file system :
Creates the following files:
- %TEMP%\Locked\la-haute-autorite\files\img\rss.gif
- %TEMP%\Locked\la-haute-autorite\files\img\scr_emailBottomCorners_580wx13h.gif
- %TEMP%\Locked\la-haute-autorite\files\img\scr_emailTopCorners_580wx13h.gif
- %TEMP%\Locked\la-haute-autorite\files\img\news_subnav_r.gif
- %TEMP%\Locked\la-haute-autorite\files\img\news_search_input.gif
- %TEMP%\Locked\la-haute-autorite\files\img\news_search_input_button.gif
- %TEMP%\Locked\la-haute-autorite\files\img\news_subnav_l.gif
- %TEMP%\Locked\la-haute-autorite\files\img\select.gif
- %TEMP%\Locked\la-haute-autorite\files\img\visa-logo.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\visalogo.gif
- %TEMP%\Locked\la-haute-autorite\files\img\vpv-header.gif
- %TEMP%\Locked\la-haute-autorite\files\img\Thumbs.db
- %TEMP%\Locked\la-haute-autorite\files\img\siteIndex_line.gif
- %TEMP%\Locked\la-haute-autorite\files\img\submit.gif
- %TEMP%\Locked\la-haute-autorite\files\img\table_header.gif
- %TEMP%\Locked\la-haute-autorite\files\img\news_search_bg.png
- %TEMP%\Locked\la-haute-autorite\files\img\mmf_nav_right_on.gif
- %TEMP%\Locked\la-haute-autorite\files\img\mmf_slice.gif
- %TEMP%\Locked\la-haute-autorite\files\img\mmf_tab.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\mmf_nav_right.gif
- %TEMP%\Locked\la-haute-autorite\files\img\mmfPage_slice.gif
- %TEMP%\Locked\la-haute-autorite\files\img\mmf_nav_left.gif
- %TEMP%\Locked\la-haute-autorite\files\img\mmf_nav_left_on.gif
- %TEMP%\Locked\la-haute-autorite\files\img\mmf_tab_on.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\nav_tab_l.gif
- %TEMP%\Locked\la-haute-autorite\files\img\news_nav.gif
- %TEMP%\Locked\la-haute-autorite\files\img\news_nav_over.gif
- %TEMP%\Locked\la-haute-autorite\files\img\nav_tab.gif
- %TEMP%\Locked\la-haute-autorite\files\img\mmf_title.gif
- %TEMP%\Locked\la-haute-autorite\files\img\navpod.gif
- %TEMP%\Locked\la-haute-autorite\files\img\nav_divider.gif
- %TEMP%\Locked\la-haute-autorite\files\js\AC_RunActiveContent.js
- %TEMP%\Locked\sites\all\themes\hadopi\images\pictos\pi_deficients_visuels.png
- %TEMP%\Locked\sites\all\themes\hadopi\images\puces\puces_liens.png
- %TEMP%\Locked\sites\all\themes\hadopi\images\puces\puces_pagination_article.png
- %TEMP%\Locked\la-haute-autorite\index.html
- %TEMP%\Locked\la-haute-autorite\files\js\validator.js
- %TEMP%\Locked\la-haute-autorite\files\js\VerificationAddCC.js
- %TEMP%\Locked\la-haute-autorite\files\js\visa-logo.js
- %TEMP%\Locked\sites\all\themes\hadopi\images\puces\puce_lien_fleche.png
- %TEMP%\Locked\sites\default\files\css\css_a203287d7847c3ae28054463617d740f.css
- %TEMP%\Locked\sites\default\files\css\css_b9ef205d5950021ac7c1fc07af48a12d.css
- %TEMP%\Locked\sites\default\files\Haute_autorite_presentation.jpg
- %TEMP%\Locked\sites\all\themes\hadopi\images\visuels\logo_site_hadopi_blanc.png
- %TEMP%\Locked\sites\all\themes\hadopi\images\puces\puce_titre.png
- %TEMP%\Locked\sites\all\themes\hadopi\images\puces\puce_titre_paragraphe.png
- %TEMP%\Locked\sites\all\themes\hadopi\images\visuels\logo_site_hadopi.png
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-da.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-de.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-en.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-cz.js
- %TEMP%\Locked\la-haute-autorite\files\js\dropdown.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery-1.4.4.min.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-es.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-pt.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-ro.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-ru.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-nl.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-fr.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-it.js
- %TEMP%\Locked\la-haute-autorite\files\js\jquery.validationEngine-ja.js
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idoc5fc0.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idoc61ee.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idoc785d.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idoc5175.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\CB.gif
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idoc163e.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idoc353b.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idoc7985.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idocd4e3.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idocf4b6.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idocfef2.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idocd026.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idoc8e41.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idocbf84.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\contact\idoccd49.jpg
- %TEMP%\Locked\la-haute-autorite\files\img\arrow_grey_up.gif
- %TEMP%\Locked\la-haute-autorite\files\css\home_page.css
- %TEMP%\Locked\la-haute-autorite\files\css\internal_page.css
- %TEMP%\Locked\la-haute-autorite\files\css\pods.css
- %TEMP%\Locked\la-haute-autorite\files\css\global.css
- %TEMP%\Up.exe
- %TEMP%\run.bat
- %TEMP%\Locked\la-haute-autorite\files\css\body.css
- %TEMP%\Locked\la-haute-autorite\files\css\screenshot.png
- %TEMP%\Locked\la-haute-autorite\files\css\validationEngine.jquery.css
- %TEMP%\Locked\la-haute-autorite\files\css\WebResourceee90.css
- %TEMP%\Locked\la-haute-autorite\files\img\arrow_blue.gif
- %TEMP%\Locked\la-haute-autorite\files\css\template.css
- %TEMP%\Locked\la-haute-autorite\files\css\sectionhome_page.css
- %TEMP%\Locked\la-haute-autorite\files\css\standard.css
- %TEMP%\Locked\la-haute-autorite\files\css\styles.css
- %TEMP%\Locked\la-haute-autorite\files\img\contact\Thumbs.db
- %TEMP%\Locked\la-haute-autorite\files\img\flags\turkey.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\uk.gif
- %TEMP%\Locked\la-haute-autorite\files\img\footerheader.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\Thumbs.db
- %TEMP%\Locked\la-haute-autorite\files\img\flags\spain.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\sweden.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\switzerland.gif
- %TEMP%\Locked\la-haute-autorite\files\img\global_search_input.gif
- %TEMP%\Locked\la-haute-autorite\files\img\MASTERCARD.gif
- %TEMP%\Locked\la-haute-autorite\files\img\mini_cvv2.gif
- %TEMP%\Locked\la-haute-autorite\files\img\mmfpagenav_r.png
- %TEMP%\Locked\la-haute-autorite\files\img\mail_blue.gif
- %TEMP%\Locked\la-haute-autorite\files\img\global_search_input_button.gif
- %TEMP%\Locked\la-haute-autorite\files\img\gold_arrow.gif
- %TEMP%\Locked\la-haute-autorite\files\img\header.png
- %TEMP%\Locked\la-haute-autorite\files\img\flags\romania.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\austria.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\belgium.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\bulgaria.gif
- %TEMP%\Locked\la-haute-autorite\files\img\download.png
- %TEMP%\Locked\la-haute-autorite\files\img\contentbody.gif
- %TEMP%\Locked\la-haute-autorite\files\img\contentfooter.gif
- %TEMP%\Locked\la-haute-autorite\files\img\contentheader.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\czechrepublic.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\netherlands.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\norway.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\poland.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\italy.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\finland.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\germany.gif
- %TEMP%\Locked\la-haute-autorite\files\img\flags\greece.gif
Sets the 'hidden' attribute to the following files:
- %TEMP%\Locked\la-haute-autorite\files\img\Thumbs.db
- %TEMP%\Locked\la-haute-autorite\files\img\flags\Thumbs.db
- %TEMP%\Locked\la-haute-autorite\files\img\contact\Thumbs.db
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
