Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'drvsyskit' = '%APPDATA%\drivers\winupgro.exe'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\srosa] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\srosa] 'ImagePath' = '%APPDATA%\drivers\wfsintwq.sys'
Creates the following services
- 'srosa' %APPDATA%\drivers\wfsintwq.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Update
- Windows Security Center
- Windows Defender
blocks the following features:
- User Account Control (UAC)
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %APPDATA%\drivers\winupgro.exe
- %APPDATA%\drivers\srosa2.sys
- %APPDATA%\drivers\wfsintwq.sys
- %WINDIR%\temp\udd6cc6.tmp
Deletes the following files
- %WINDIR%\temp\udd6cc6.tmp
Network activity
Connects to
- 'google.com':80
- 'ne###zone.com':80
- 'si###chland.net':80
- 'bi##pe.dk':80
- 'vi###aweb.ch':80
- 'ge###t.com.br':80
- 'tn#.com.br':80
- 'tn#.com.br':443
- 'el####ng.aab-net.dk':80
TCP
HTTP GET requests
- http://ne###zone.com/images/abc.php?cr#####
- http://www.si###chland.net/images/abc.php?cr#####
- http://bi##pe.dk/images/abc.php?cr#####
- http://www.vi###aweb.ch/images/abc.php?cr#####
- http://ge###t.com.br/images/abc.php?cr#####
- http://www.tn#.com.br/images/abc.php?cr#####
Other
- 'tn#.com.br':443
UDP
- DNS ASK google.com
- DNS ASK ne###zone.com
- DNS ASK ge##elp.gr
- DNS ASK si###chland.net
- DNS ASK tr####ardan.com.ar
- DNS ASK es####emos.com.br
- DNS ASK bi##pe.dk
- DNS ASK vi###aweb.ch
- DNS ASK sa####guros.com.br
- DNS ASK ge###t.com.br
- DNS ASK tn#.com.br
- DNS ASK in######astodoflex.com.ar
- DNS ASK el####ng.aab-net.dk
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
- ClassName: 'AavmMessageClass' WindowName: ''
Creates and executes the following
- '%APPDATA%\drivers\winupgro.exe'
- '%APPDATA%\drivers\winupgro.exe' ' (with hidden window)
