Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Windows Update 944930304' = '%WINDIR%\5528188816023192\winvmuv.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'Windows Update 944930304' = '%WINDIR%\5528188816023192\winvmuv.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft Windows Driver' = '%WINDIR%\1976415059\sysyery.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft Windows Driver' = '%WINDIR%\1976415059\sysyery.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft Windows Driver' = '%WINDIR%\1524913244\syszybj.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft Windows Driver' = '%WINDIR%\1524913244\syszybj.exe'
Creates the following files on removable media
- <Drive name for removable media>:\__\drivemgr.exe
- <Drive name for removable media>:\digest.rdf
- <Drive name for removable media>:\schema.rdf
- <Drive name for removable media>:\contenttypes.rdf
- <Drive name for removable media>:\skos.rdf
- <Drive name for removable media>:\sioc.rdf
- <Drive name for removable media>:\taxus_baccata.rdf
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\spib_pima.pdf
- <Drive name for removable media>:\file1.ppt
- <Drive name for removable media>:\writingcompletesarnarrative_1103.ppt
- <Drive name for removable media>:\ppswamp.ppt
- <Drive name for removable media>:\accountsreceivable.ppt
- <Drive name for removable media>:\cbz.png
- <Drive name for removable media>:\arrow-down.png
- <Drive name for removable media>:\cleanlyrics.png
- <Drive name for removable media>:\breakpoint.png
- <Drive name for removable media>:\calibre.png
- <Drive name for removable media>:\asm.png
- <Drive name for removable media>:\server.pem
- <Drive name for removable media>:\ck_ugo.pem
- <Drive name for removable media>:\mappingconcepthubberlin.ppt
- <Drive name for removable media>:\lom602.pdf
- <Drive name for removable media>:\pubnet_855.rtf
- <Drive name for removable media>:\guide_reorganization_mapping.xls
- <Drive name for removable media>:\productos.zip
- <Drive name for removable media>:\calculatorworksheet.zip
- <Drive name for removable media>:\1sm_price.zip
- <Drive name for removable media>:\removedtitles_records.zip
- <Drive name for removable media>:\contractualdeadlines.zip
- <Drive name for removable media>:\price.zip
- <Drive name for removable media>:\national_autism_preparation_programs.xlsx
- <Drive name for removable media>:\al.xlsx
- <Drive name for removable media>:\2013_finalsummaryforweb.xlsx
- <Drive name for removable media>:\2013_smccc_competition_points_jul2013.xlsx
- <Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx
- <Drive name for removable media>:\military_callsigns_0311.rtf
- <Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf
- <Drive name for removable media>:\fiche_inscription_2015.xls
- <Drive name for removable media>:\price030215.xls
- <Drive name for removable media>:\productos.xls
- <Drive name for removable media>:\calculatorworksheet.xls
- <Drive name for removable media>:\1sm_price.xls
- <Drive name for removable media>:\testwmv.wmv
- <Drive name for removable media>:\babyboymaintoscenesbackground.wmv
- <Drive name for removable media>:\passport_pal.wmv
- <Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv
- <Drive name for removable media>:\pandp.rtf
- <Drive name for removable media>:\router_manual.rtf
- <Drive name for removable media>:\excel_example.xls
- <Drive name for removable media>:\7790_preview.pdf
- <Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf
- <Drive name for removable media>:\ff_ot_user_guide.pdf
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\cveuropeo.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\dotnetfx45_full_setup.exe
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\.lnk
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\trivial-merge.htm
- <Drive name for removable media>:\sdszfo.docx
- <Drive name for removable media>:\garden.htm
- <Drive name for removable media>:\video_1.mp4
- <Drive name for removable media>:\13.jpeg
- <Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
- <Drive name for removable media>:\etc6_m_1.mov
- <Drive name for removable media>:\spanner.mov
- <Drive name for removable media>:\scan.mov
- <Drive name for removable media>:\pushkin.jpg
- <Drive name for removable media>:\3.jpg
- <Drive name for removable media>:\1189.jpg
- <Drive name for removable media>:\parnas_01.jpg
- <Drive name for removable media>:\parnas_01.jpeg
- <Drive name for removable media>:\3.jpeg
- <Drive name for removable media>:\4f0bf7ff71f28.jpeg
- <Drive name for removable media>:\pushkin.jpeg
- <Drive name for removable media>:\tree_view.htm
- <Drive name for removable media>:\region-north-karelia.jpeg
- <Drive name for removable media>:\2.jpeg
- <Drive name for removable media>:\about.html
- <Drive name for removable media>:\trivial-merge.html
- <Drive name for removable media>:\alert.html
- <Drive name for removable media>:\ituneshelpunavailable.html
- <Drive name for removable media>:\about.htm
- <Drive name for removable media>:\browse.htm
- <Drive name for removable media>:\ituneshelpunavailable.htm
- <Drive name for removable media>:\64bit_notes.htm
- <Drive name for removable media>:\alert.htm
- <Drive name for removable media>:\price030215.zip
- <Drive name for removable media>:\subjectclassification.zip
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
- Windows Security Center
Creates and executes the following
- '' (downloaded from the Internet)
Modifies file system
Creates the following files
- %TEMP%\d48d.exe
- %WINDIR%\5528188816023192\winvmuv.exe
- %TEMP%\1724.exe
- %WINDIR%\1976415059\sysyery.exe
- %WINDIR%\1524913244\syszybj.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\5528188816023192\winvmuv.exe
- %WINDIR%\1976415059\sysyery.exe
- %WINDIR%\1524913244\syszybj.exe
- <Drive name for removable media>:\.lnk
Network activity
TCP
HTTP GET requests
- http://18#.#76.27.132/p.exe
- http://18#.#76.27.132/t.php?ne###
UDP
- DNS ASK ur#####fhsorhfuuhp.su
- DNS ASK rz#####ugugfugugsp.su
- DNS ASK da#####eauehfuuhfp.su
- DNS ASK ae#####oheguaoehdp.su
- DNS ASK eg#####ghouughahsp.su
- DNS ASK af#####ifgsgrhhafp.su
- DNS ASK af#####igieufuifip.su
Miscellaneous
Creates and executes the following
- '%TEMP%\d48d.exe'
- '%WINDIR%\5528188816023192\winvmuv.exe'
- '%TEMP%\1724.exe'
- '%WINDIR%\1976415059\sysyery.exe'
- '%WINDIR%\1524913244\syszybj.exe'
