Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\APCWSC] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\APCWSC] 'ImagePath' = '<SYSTEM32>\APCWSC.exe'
Creates the following services
- 'APCWSC' <SYSTEM32>\APCWSC.exe
Malicious functions
Injects code into
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %WINDIR%\syswow64\apcwsc.exe
- %WINDIR%\syswow64\ald_softdos.dll
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\favorites\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\internet explorer\recovery\high\active\recoverystore.{88a7ea43-b72b-11ed-b84a-54665e7f103f}.dat
- %WINDIR%\temp\~dfcf76386f83cb3485.tmp
- %WINDIR%\syswow64\config\systemprofile\favorites\links\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\internet explorer\recovery\high\active\{88a7ea44-b72b-11ed-b84a-54665e7f103f}.dat
- %WINDIR%\temp\~df20acf70273392755.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\62axopq5\favicon[1].ico
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico
Deletes itself.
Network activity
Connects to
- 'bing.com':80
TCP
HTTP GET requests
- http://www.bing.com/favicon.ico
UDP
- DNS ASK bing.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\apcwsc.exe'
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul' (with hidden window)
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
- '%WINDIR%\syswow64\ie4uinit.exe' -ShowQLIcon
