Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Win32system' = 'c:\NYboy.vbs'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'ScanRegistry' = ''
Creates the following files on removable media
- <Drive name for removable media>:\<File name>.vbs
- <Drive name for removable media>:\nyboy.bat
- <Drive name for removable media>:\autorun.inf
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks execution of the following system utilities:
- Registry Editor (RegEdit)
modifies the following system settings:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayContextMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoNetHood' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetTaskbar' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFavoritesMenu' = '00000001'
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- C:\<File name>.vbs
- D:\<File name>.vbs
- C:\nyboy.bat
- D:\nyboy.bat
- C:\autorun.inf
- D:\autorun.inf
Sets the 'hidden' attribute to the following files
- <PATH_SAMPLE>.vbs
- C:\autorun.inf
- D:\autorun.inf
- C:\nyboy.bat
- D:\nyboy.bat
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\nyboy.bat
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c echo [AutoRun]>>C:\autorun.inf&& echo open=NYboy.bat >>C:\autorun.inf&& echo shellexecute=NYboy.bat >>C:\autorun.inf&& echo shell\Auto\command=NYboy.bat>>C:\autorun.inf&& echo shell=Auto>>C:...
- '<SYSTEM32>\cmd.exe' /c echo [AutoRun]>>D:\autorun.inf&& echo open=NYboy.bat >>D:\autorun.inf&& echo shellexecute=NYboy.bat >>D:\autorun.inf&& echo shell\Auto\command=NYboy.bat>>D:\autorun.inf&& echo shell=Auto>>D:...
- '<SYSTEM32>\cmd.exe' /c echo [AutoRun]>>E:\autorun.inf&& echo open=NYboy.bat >>E:\autorun.inf&& echo shellexecute=NYboy.bat >>E:\autorun.inf&& echo shell\Auto\command=NYboy.bat>>E:\autorun.inf&& echo shell=Auto>>E:...
- '<SYSTEM32>\cmd.exe' /c echo [AutoRun]>><Drive name for removable media>:\autorun.inf&& echo open=NYboy.bat >><Drive name for removable media>:\autorun.inf&& echo shellexecute=NYboy.bat >><Drive name for removable ...
- '<SYSTEM32>\attrib.exe' +h +s +r C:\autorun.inf
- '<SYSTEM32>\cmd.exe' /c echo [AutoRun]>>I:\autorun.inf&& echo open=NYboy.bat >>I:\autorun.inf&& echo shellexecute=NYboy.bat >>I:\autorun.inf&& echo shell\Auto\command=NYboy.bat>>I:\autorun.inf&& echo shell=Auto>>I:...
- '<SYSTEM32>\cmd.exe' /c attrib +h +s +r C:\NYboy.bat&& attrib +h +s +r D:\NYboy.bat&& attrib +h +s +r E:\NYboy.bat&& attrib +h +s +r <Drive name for removable media>:\NYboy.bat&& attrib +h +s +r I:\NYboy.bat
- '<SYSTEM32>\attrib.exe' +h +s +r D:\autorun.inf
- '<SYSTEM32>\attrib.exe' +h +s +r C:\NYboy.bat
- '<SYSTEM32>\attrib.exe' +h +s +r D:\NYboy.bat
- '<SYSTEM32>\attrib.exe' +h +s +r <Drive name for removable media>:\autorun.inf
- '<SYSTEM32>\attrib.exe' +h +s +r E:\NYboy.bat
- '<SYSTEM32>\attrib.exe' +h +s +r <Drive name for removable media>:\NYboy.bat
- '<SYSTEM32>\attrib.exe' +h +s +r I:\NYboy.bat
