Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Java Updater' = '%ALLUSERSPROFILE%\Java Updater\1o9uwe3171u7.exe'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Java Updater' = '"%ALLUSERSPROFILE%\Java Updater\1o9uwe3171u7.exe"'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe] 'Debugger' = 'lwsuavn.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe] 'Debugger' = 'wyzwpmmuc.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe] 'Debugger' = 'mhdabzsy.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mrtstub.exe] 'Debugger' = 'pzmgeikz.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe] 'Debugger' = 'tvqjdcja.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe] 'Debugger' = 'guucwyigshu.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe] 'Debugger' = 'wctzbgxyehm.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrtstub.exe] 'Debugger' = 'rshqutnipto.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmgr108.exe] 'Debugger' = 'gucwcviga.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent e70d8f25b51b7837
- <SYSTEM32>\tasks\windows update check - 0x1bb70478
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\SSDPSRV] 'Start' = '00000002'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
- Windows Action Center
modifies the following system settings:
- Hides taskbar notifications
Injects code into
the following system processes:
- %WINDIR%\syswow64\regedit.exe
the following user processes:
- iexplore.exe
- firefox.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\schtasks.exe
Searches for windows to
detect analytical utilities:
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'TIdaWindow', WindowName: ''
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2500' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2500' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2500' = '00000003'
Modifies file system
Creates the following files
- %APPDATA%\ubivswr
- %TEMP%\a479.exe
- %TEMP%\c14c.exe
- %TEMP%\1o9uwe3171u7_1.exe
- %TEMP%\1o9uwe3171u7_1.exe:1bb7fb68
Sets the 'hidden' attribute to the following files
- %APPDATA%\ubivswr
- %ALLUSERSPROFILE%\java updater\1o9uwe3171u7.exe
Deletes the following files
- <SYSTEM32>\tasks\firefox default browser agent e70d8f25b51b7837
Moves the following files
- from %TEMP%\a479.exe to %ALLUSERSPROFILE%\java updater\1o9uwe3171u7.exe
Deletes itself.
Network activity
Connects to
- 'ho####ile-host6.com':80
- 'cu####dlover.com':80
TCP
HTTP POST requests
- http://ho####ile-host6.com/
- http://cu####dlover.com/client/register.php?pi####
UDP
- DNS ASK ho####ile-host6.com
- DNS ASK windowsupdate.microsoft.com
- DNS ASK cu####dlover.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'GMER'
- ClassName: '' WindowName: 'Monitoring - API Monitor v2 32-bit'
Creates and executes the following
- '%TEMP%\a479.exe'
- '%TEMP%\c14c.exe'
- '%TEMP%\1o9uwe3171u7_1.exe'
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1BB70478" /TR "C:\PROGRA~3\JAVAUP~1\1O9UWE~1.EXE" /RL HIGHEST' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\syswow64\regedit.exe'
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1BB70478" /TR "C:\PROGRA~3\JAVAUP~1\1O9UWE~1.EXE" /RL HIGHEST
