Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\wuauserv] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wuauserv] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop wuauserv /y
- '<SYSTEM32>\net.exe' stop bits /y
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\751f.tmp\7530.bat
- %TEMP%\rgie511.tmp
- %TEMP%\rgie5fc.tmp
- %WINDIR%\temp\rgiecdd.tmp
- %WINDIR%\softwaredistribution\wuredir\9482f4b4-e343-43b6-b170-9a65bc822c77\muv4wuredir.cab
- %WINDIR%\softwaredistribution\wuredir\9482f4b4-e343-43b6-b170-9a65bc822c77\wuredir.cab
- %WINDIR%\temp\outofprocreport1210358.txt
- %ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_7.5.7601.17514_f5cd445b1dfc1c5779c1b1174e5da85951337_cab_09fe7648\report.wer
Deletes the following files
- %WINDIR%\softwaredistribution\DataStore\logs\edb.chk
- %WINDIR%\softwaredistribution\DataStore\logs\edb.log
- %WINDIR%\softwaredistribution\DataStore\logs\edb00002.log
- %WINDIR%\softwaredistribution\download\94802b1b3adeeb4feecfe2afe338b652\cbshandler\state
- %WINDIR%\windowsupdate.log
- %WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\windowsupdate.log
- %TEMP%\rgie511.tmp
- %TEMP%\rgie5fc.tmp
- %WINDIR%\temp\rgiecdd.tmp
- %TEMP%\751f.tmp\7530.bat
- %WINDIR%\temp\outofprocreport1210358.txt
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\751F.tmp\7530.bat <Full path to file>"
- '<SYSTEM32>\wuauclt.exe' /detectnow
- '<SYSTEM32>\wuauclt.exe' /resetauthorization
- '<SYSTEM32>\net1.exe' start bits /y
- '<SYSTEM32>\net.exe' start bits /y
- '<SYSTEM32>\net1.exe' start wuauserv /y
- '<SYSTEM32>\net.exe' start wuauserv /y
- '<SYSTEM32>\regsvr32.exe' <SYSTEM32>\wuweb.dll /s
- '<SYSTEM32>\regsvr32.exe' <SYSTEM32>\wups2.dll /s
- '<SYSTEM32>\regsvr32.exe' <SYSTEM32>\wuaueng1.dll /s
- '<SYSTEM32>\regsvr32.exe' <SYSTEM32>\msxml3.dll /s
- '<SYSTEM32>\regsvr32.exe' <SYSTEM32>\wucltui.dll /s
- '<SYSTEM32>\regsvr32.exe' <SYSTEM32>\wuaueng.dll /s
- '<SYSTEM32>\regsvr32.exe' <SYSTEM32>\wups.dll /s
- '<SYSTEM32>\regsvr32.exe' <SYSTEM32>\wuapi.dll /s
- '<SYSTEM32>\reg.exe' Delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v NextDetectionTime /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v DetectionstartTime /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v LastWaitTimeout /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientValidation /f
- '<SYSTEM32>\reg.exe' Delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
- '<SYSTEM32>\net1.exe' stop bits /y
- '<SYSTEM32>\net1.exe' stop wuauserv /y
- '<SYSTEM32>\wuauclt.exe' /reportnow
- '<SYSTEM32>\wermgr.exe' "-outproc" "820" "3476"
