Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\cmd
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\idle
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\payload.data
- C:\documents and settings\6cb0b6c459d5d3455a3da700e713f2e2529862ff
- C:\documents and settings\dwm.exe
- <SYSTEM32>\printui\560854153607923c4c5f107085a7db67be01f252
- <SYSTEM32>\printui\wininit.exe
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\pdm\559fba5f8e44108851927af432f0edac6117c574
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\pdm\mdm.exe
- %ALLUSERSPROFILE%\start menu\0fc223bdacedc38dd6d2772d547ade1563558e92
- %ALLUSERSPROFILE%\start menu\firefox.exe
- C:\documents and settings\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- C:\documents and settings\iexplore.exe
- <Current directory>\ebf1f9fa8afd6d1932bd65bc4cc3af89a4c8e228
- <Current directory>\cmd.exe
- %WINDIR%\apppatch\886983d96e3d3e31032c679b2d4ea91b6c05afef
- %WINDIR%\apppatch\csrss.exe
- <Current directory>\480b7989c529f6ff17bde430d81d4770fb5337f5
- <Current directory>\wudfhost.exe
- %TEMP%\7zipsfx.000\extracted\runtimemonitornetintobroker.exe
- %TEMP%\7zipsfx.000\extracted\file_1.zip
- %TEMP%\7zipsfx.000\extracted\file_2.zip
- %TEMP%\7zipsfx.000\extracted\file_3.zip
- %TEMP%\7zipsfx.000\extracted\antiscan.data
- %TEMP%\7zipsfx.000\extracted\file_4.zip
- %TEMP%\7zipsfx.000\7z.exe
- %TEMP%\7zipsfx.000\7z.dll
- %TEMP%\7zipsfx.000\svchost.cmd
- C:\totalcmd\language\idle.exe
- C:\totalcmd\language\6ccacd8608530fba3a93e87ae2225c7032aa18c1
Sets the 'hidden' attribute to the following files
- %TEMP%\7zipsfx.000\runtimemonitornetintobroker.exe
Deletes the following files
- %TEMP%\7zipsfx.000\extracted\file_1.zip
- %TEMP%\7zipsfx.000\extracted\file_2.zip
- %TEMP%\7zipsfx.000\extracted\file_3.zip
- %TEMP%\7zipsfx.000\extracted\file_4.zip
Moves the following files
- from %TEMP%\7zipsfx.000\payload.data to %TEMP%\7zipsfx.000\file.zip
- from %TEMP%\7zipsfx.000\extracted\runtimemonitornetintobroker.exe to %TEMP%\7zipsfx.000\runtimemonitornetintobroker.exe
Substitutes the following files
- %TEMP%\7zipsfx.000\payload.data
Network activity
Connects to
- '62.##9.16.223':80
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\7z.exe' e file.zip -p___________1338pwd352pwd5383___________ -oextracted
- '%TEMP%\7zipsfx.000\7z.exe' e extracted/file_4.zip -oextracted
- '%TEMP%\7zipsfx.000\7z.exe' e extracted/file_3.zip -oextracted
- '%TEMP%\7zipsfx.000\7z.exe' e extracted/file_2.zip -oextracted
- '%TEMP%\7zipsfx.000\7z.exe' e extracted/file_1.zip -oextracted
- '%TEMP%\7zipsfx.000\runtimemonitornetintobroker.exe'
- 'C:\documents and settings\iexplore.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\svchost.cmd" /S"' (with hidden window)
- 'C:\documents and settings\iexplore.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\svchost.cmd" /S"
- '<SYSTEM32>\mode.com' 65,10
- '<SYSTEM32>\attrib.exe' +H "RuntimemonitornetIntoBroker.exe"
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%WINDIR%\AppPatch\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc ONLOGON /tr "'<Current directory>\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Documents and Settings\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Start Menu\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\pdm\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'<SYSTEM32>\printui\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Documents and Settings\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\Idle.exe'" /rl HIGHEST /f
