Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Explorer' = '%WINDIR%\system\explorer.exe RO'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Svchost' = '%WINDIR%\system\svchost.exe RO'
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = '%WINDIR%\explorer.exe, %WINDIR%\system\explorer.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}] 'StubPath' = '%APPDATA%\mrsys.exe MR'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}] 'StubPath' = '%APPDATA%\mrsys.exe MR'
Creates or modifies the following files
- %WINDIR%\tasks\at1.job
- <SYSTEM32>\tasks\at1
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Schedule] 'Start' = '00000002'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Executes the following
- '%WINDIR%\syswow64\at.exe' 16:48 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe
- '%WINDIR%\syswow64\at.exe' 16:49 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe
Modifies file system
Creates the following files
- %WINDIR%\system\explorer.exe
- %WINDIR%\system\spoolsv.exe
- %WINDIR%\system\svchost.exe
- %APPDATA%\mrsys.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
Sets the 'hidden' attribute to the following files
- %WINDIR%\system\explorer.exe
- %WINDIR%\system\spoolsv.exe
- %WINDIR%\system\svchost.exe
- %APPDATA%\mrsys.exe
Deletes the following files
- %WINDIR%\tasks\at1.job
- <SYSTEM32>\tasks\at1
Miscellaneous
Creates and executes the following
- '%WINDIR%\system\explorer.exe'
- '%WINDIR%\system\spoolsv.exe' SE
- '%WINDIR%\system\svchost.exe'
- '%WINDIR%\system\spoolsv.exe' PR
- '%WINDIR%\system\explorer.exe' ' (with hidden window)
- '%WINDIR%\system\spoolsv.exe' SE' (with hidden window)
- '%WINDIR%\system\svchost.exe' ' (with hidden window)
- '%WINDIR%\system\spoolsv.exe' PR' (with hidden window)
- '%WINDIR%\syswow64\at.exe' 16:48 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe' (with hidden window)
- '%WINDIR%\syswow64\at.exe' 16:49 /interactive /every:M,T,W,Th,F,S,Su %WINDIR%\system\svchost.exe' (with hidden window)
