Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] ' krcdh' = '"<LS_APPDATA>\hena\hena.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ' krcdh' = '"<LS_APPDATA>\hena\hena.exe"'
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Injects code into
the following system processes:
- <SYSTEM32>\regsvr32.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000003'
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\WindowsXP-KB968930-x86-ENG[1].exe
- %TEMP%\WindowsXP-KB968930-x86-ENG.exe
- <LS_APPDATA>\hena\hena.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\microsoft[1]
Deletes the following files:
- <Full path to file>
Network activity:
Connects to:
- '19#.#3.87.88':80
- '22#.#19.230.202':80
- '22#.#30.105.41':80
- '10.##4.25.37':80
- '26.##2.135.164':80
- '13#.#02.182.4':80
- '91.##4.215.255':80
- '21#.#68.38.190':80
- '59.##9.218.186':443
- '62.##3.74.147':80
- '13#.#6.208.120':80
- '24#.#22.22.68':80
- '10#.#49.40.23':80
- '51.##3.169.152':80
- '67.##.174.205':80
- '30.##5.124.175':80
- '22#.#75.223.194':80
- '16#.#18.201.4':80
- '18#.#9.37.94':80
- '16.#.150.203':8080
- '21#.#9.227.83':80
- '40.##.28.224':80
- '16#.#7.254.112':80
- '17#.#04.254.65':443
- '22#.#14.186.100':443
- '97.##9.63.66':80
- '20#.#6.232.182':80
- '10.##3.74.15':8080
- '68.##1.196.6':80
- '4.##.71.193':80
- '18#.#32.74.168':80
- '25#.#8.54.67':80
- '25#.#0.12.133':8080
- '15#.#4.100.7':80
- '72.##8.186.224':80
- '21#.#33.15.166':80
- '22#.#84.183.204':80
- '15.##5.51.45':80
- '81.##4.125.157':80
- '64.##.190.21':80
TCP:
HTTP GET requests:
- http://download.microsoft.com/download/E/C/E/ECE99583-2003-455D-B681-68DB610B44A4/WindowsXP-KB968930-x86-ENG.exe via 20#.#6.232.182
- http://microsoft.com/ via 20#.#6.232.182
UDP:
- DNS ASK download.microsoft.com
- DNS ASK microsoft.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\WindowsXP-KB968930-x86-ENG.exe' /quiet /norestart
- '<Full path to file>'
Executes the following:
- '<SYSTEM32>\regsvr32.exe'
