Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%ALLUSERSPROFILE%\Application Data\JavaTM\LaunchTM.exe'
Malicious functions:
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\JavaTM\LaunchTM.exe.config
- %ALLUSERSPROFILE%\Application Data\JavaTM\LaunchTM.exe
Network activity:
Connects to:
- '15#.#53.23.121':80
- 'go##onym.se':80
- 'wp#d':80
TCP:
HTTP GET requests:
- http://15#.#53.23.121/pschool/plugins/DebugKit/View/inc/?do############################
- http://go##onym.se/wp-admin/network/inc/?do############################
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK go##onym.se
- DNS ASK wp#d
Miscellaneous:
Executes the following:
- '<SYSTEM32>\cmd.exe' /C reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot" /f /reg:64
- '<SYSTEM32>\cmd.exe' /C reg add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot" /v AlternateShell /t REG_SZ /d cmd.exe_ /f
- '<SYSTEM32>\cmd.exe' /C reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot" /f
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {current} bootstatuspolicy IgnoreAllFailures
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {current} recoveryenabled off
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot" /f /reg:64
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot" /v AlternateShell /t REG_SZ /d cmd.exe_ /f /reg:64
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot" /v AlternateShell /t REG_SZ /d cmd.exe_ /f
- '<SYSTEM32>\cmd.exe' /C reg add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot" /v AlternateShell /t REG_SZ /d cmd.exe_ /f /reg:64
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot" /f
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {current} optionsedit off
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "userinit.exe,%ALLUSERSPROFILE%\Application Data\JavaTM\LaunchTM.exe" /f
- '<SYSTEM32>\cmd.exe' /C reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "" /f /reg:64
- '<SYSTEM32>\cmd.exe' /C reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "" /f
- '<SYSTEM32>\cmd.exe' /C reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "userinit.exe,%ALLUSERSPROFILE%\Application Data\JavaTM\LaunchTM.exe" /f
- '<SYSTEM32>\cmd.exe' /C reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "userinit.exe,%ALLUSERSPROFILE%\Application Data\JavaTM\LaunchTM.exe" /f /reg:64
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "userinit.exe,%ALLUSERSPROFILE%\Application Data\JavaTM\LaunchTM.exe" /f /reg:64
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {current} advancedoptions off
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "" /f /reg:64
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "" /f
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {current} bootems off
