Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'QuickSeeker20130820-Protector' = 'C:\QuickSeeker20130820\Protector.exe'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'QuickSeeker20130820-Connector' = 'C:\QuickSeeker20130820\Connector.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /IM Protector.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM Connector.exe /F
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\nszb25e.tmp\system.dll
- %LOCALAPPDATA%\context2pro\libwindoc.exe
- %LOCALAPPDATA%\context2pro\notifications.exe
- %LOCALAPPDATA%\context2pro\contextprod.exe
- %LOCALAPPDATA%\context2pro\conadvanced.exe
- %LOCALAPPDATA%\context2pro\context2pro_uninstaller.exe
- %LOCALAPPDATA%\context2pro\rscnet.exe
- %TEMP%\nsuc6f7.tmp\system.dll
- C:\quickseeker20130820\uninstall.cmd
- C:\quickseeker20130820\sqlite3.dll
- C:\quickseeker20130820\runonce.cmd
- C:\quickseeker20130820\connector.exe
- C:\quickseeker20130820\ie_home.bat
- C:\quickseeker20130820\protector.exe
- C:\quickseeker20130820\bl_search.txt
- C:\quickseeker20130820\bl_home.txt
- %TEMP%\gems\gemshome.exe
- %TEMP%\gems\gemscontexthelper.exe
- %LOCALAPPDATA%\context2pro\contextfr.exe
- %LOCALAPPDATA%\context2pro\contextnav.exe
Deletes the following files
- %TEMP%\nszb25e.tmp\system.dll
- %LOCALAPPDATA%\context2pro\rscnet.exe
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
Network activity
Connects to
- 'tw##ter.com':80
- 'fa###ook.com':80
- 'qu####seeker.com':80
- 'fa##book.es':80
- 'my##ace.com':80
TCP
HTTP POST requests
- http://www.qu####seeker.com/api/signup
Other
- '34.##9.100.209':443
UDP
- DNS ASK tu##ti.com
- DNS ASK tw##ter.com
- DNS ASK fa##book.es
- DNS ASK fa###ook.com
- DNS ASK my##ace.com
- DNS ASK qu####seeker.com
- DNS ASK in####adtivity.net
- DNS ASK up####ential.net
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\gems\gemscontexthelper.exe'
- '%TEMP%\gems\gemshome.exe' 1 1 "www.quick-seeker.com/sf" "QuickSeeker 20130820" "http://www.quick-seeker.com/sf/search[qmark]q=" 30 1 1 3 "http://www.quick-seeker.com/api/signup"
- '%LOCALAPPDATA%\context2pro\conadvanced.exe' -godirectly -quitafter -bat -ping -part 1081 -soft null
- 'C:\quickseeker20130820\protector.exe' 1 1 "www.quick-seeker.com/sf" "QuickSeeker 20130820" "http://www.quick-seeker.com/sf/search?q=" 30 1 1
- 'C:\quickseeker20130820\connector.exe' "SI" "http://www.quick-seeker.com/api/signup"
- '%LOCALAPPDATA%\context2pro\contextprod.exe' -godirectly -quitafter -bat -ping -part 1081 -soft null
- '%LOCALAPPDATA%\context2pro\contextnav.exe' -bat
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\QuickSeeker20130820\RunOnce.cmd" "
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "www.quick-seeker.com/sf" /f
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\QuickSeeker20130820\ie_home.bat" www.quick-seeker.com/sf"
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\BrowserProtector\Protector\Firefox /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\BrowserProtector\Protector\Chrome /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\BrowserProtector\Protector\IE /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\BrowserProtector\Connector /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\BrowserProtector\Protector /f
- '%WINDIR%\syswow64\cmd.exe' /c wmic useraccount where name='user' get sid
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v QuickSeeker20130820-Connector /d "C:\QuickSeeker20130820\Connector.exe" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v NoRepair /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v NoModify /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v Publisher /d "QuickSeeker20130820" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v DisplayVersion /d "1.0.0.0" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v UninstallString /d "C:\QuickSeeker20130820\Uninstall.cmd
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v DisplayIcon /d "C:\QuickSeeker20130820\Ico.ico" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v DisplayName /d "QuickSeeker20130820 v1.0" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v QuickSeeker20130820-Protector /d "C:\QuickSeeker20130820\Protector.exe" /f
- '%WINDIR%\syswow64\wbem\wmic.exe' useraccount where name='user' get sid
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\QuickSeeker20130820\ie_home.bat" www.quick-seeker.com/sf"' (with hidden window)