Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RpgNgguq' = '%LOCALAPPDATA%\jjoxvdla\rpgngguq.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,%LOCALAPPDATA%\jjoxvdla\rpgngguq.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%LOCALAPPDATA%\jjoxvdla\rpgngguq.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\rpgngguq.exe
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Update
- Windows Security Center
- Windows Defender
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Modifies file system
Creates the following files
- %WINDIR%\syswow64\mp7ig83
- %APPDATA%\appdatafr25.bin
- %LOCALAPPDATA%\jjoxvdla\rpgngguq.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\rpgngguq.exe
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\mp7ig83'
- '%LOCALAPPDATA%\jjoxvdla\rpgngguq.exe'
- '%APPDATA%\microsoft\windows\start menu\programs\startup\rpgngguq.exe'
- '%LOCALAPPDATA%\jjoxvdla\rpgngguq.exe' ' (with hidden window)
