Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2efc389dbd32f6332199df3ff6c7a762' = '"%APPDATA%\Bios.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '2efc389dbd32f6332199df3ff6c7a762' = '"%APPDATA%\Bios.exe" ..'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '"%APPDATA%\FLwwz1HSTmnQ4Z1s\jggKx70zdto8.exe",explorer.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\2efc389dbd32f6332199df3ff6c7a762.exe
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\WindowsInput] 'ImagePath' = '"<SYSTEM32>\WindowsInput.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\WindowsInput] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\Bios.exe' = '%APPDATA%\Bios.exe:*:Enabled:Bios.exe'
Creates and executes the following:
- '<SYSTEM32>\WindowsInput.exe' --install
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%APPDATA%\Bios.exe" "Bios.exe" ENABLE
- '<SYSTEM32>\WindowsInput.exe'
- '%TEMP%\tpHi3f4zOPc0oca1.exe'
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xm1w_011.cmdline"
- '%APPDATA%\Bios.exe'
Modifies file system:
Creates the following files:
- %TEMP%\xm1w_011.dll
- %TEMP%\RES2.tmp
- %TEMP%\CSC1.tmp
- <SYSTEM32>\WindowsInput.InstallState
- <SYSTEM32>\WindowsInput.exe.config
- <SYSTEM32>\WindowsInput.exe
- %TEMP%\xm1w_011.0.cs
- %TEMP%\tpHi3f4zOPc0oca1.exe
- %APPDATA%\FLwwz1HSTmnQ4Z1s\jggKx70zdto8.exe
- %APPDATA%\Bios.exe
- %TEMP%\xm1w_011.out
- %TEMP%\xm1w_011.cmdline
Sets the 'hidden' attribute to the following files:
- %APPDATA%\FLwwz1HSTmnQ4Z1s\jggKx70zdto8.exe
Deletes the following files:
- %TEMP%\xm1w_011.0.cs
- %TEMP%\xm1w_011.out
- %TEMP%\xm1w_011.dll
- %TEMP%\RES2.tmp
- %TEMP%\CSC1.tmp
- %TEMP%\xm1w_011.cmdline
Network activity:
Connects to:
- 'mi#####roja.ddns.net':2704
- 'mi#####roja.ddns.net':6600
UDP:
- DNS ASK mi#####roja.ddns.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
