Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows Media Beta' = '%WINDIR%\SysWOW64\wmpbv64.exe'
Creates the following files on removable media
- <Drive name for removable media>:\~config.{645ff040-5081-101b-9f08-00aa002f954e}\cfg-x38501943.np
- <Drive name for removable media>:\autorun.inf
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\SysWOW64\wmpbv64.exe' = '%WINDIR%\SysWOW64\wmpbv64.exe:*:En...
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%WINDIR%\SysWOW64\wmpbv64.exe' = '%WINDIR%\SysWOW64\wmpbv64.exe:*:Enab...
Injects code into
the following system processes:
- %WINDIR%\syswow64\wmpbv64.exe
- %WINDIR%\explorer.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'gdkWindowToplevel', WindowName: 'The Wireshark Network Analyzer'
- ClassName: 'SmartSniff', WindowName: 'SmartSniff'
- ClassName: 'TCPViewClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCEXPL', WindowName: ''
Modifies file system
Creates the following files
- %WINDIR%\syswow64\wmpbv64.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\wmpbv64.exe
- <Drive name for removable media>:\~config.{645ff040-5081-101b-9f08-00aa002f954e}\cfg-x38501943.np
Deletes itself.
Network activity
Connects to
- '20#.#1.237.59':80
- '66.##8.53.179':80
- '31.##6.102.158':80
TCP
HTTP GET requests
- http://20#.#1.237.59/aspnet_client/ip/n0x8d.txt
UDP
- DNS ASK th#.#rapaima.su
- DNS ASK ou#.#rapaima.su
- DNS ASK 01#.#ocaccio.su
Miscellaneous
Searches for the following windows
- ClassName: 'CNetmonMainFrame' WindowName: 'Microsoft Network Monitor 3.3'
- ClassName: 'CurrPorts' WindowName: 'CurrPorts'
- ClassName: '#32770' WindowName: 'Regshot 1.8.2'
Creates and executes the following
- '%WINDIR%\syswow64\wmpbv64.exe' <Full path to file>
- '%WINDIR%\syswow64\wmpbv64.exe' <Full path to file>' (with hidden window)
Restarts the analyzed sample
