Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'RUN.exe' = '"%TEMP%\~1885365404620527869\RUN.exe"'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'Win32system' = 'c:\NYboy.vbs'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'ScanRegistry' = ''
Creates the following files on removable media
- <Drive name for removable media>:\panda.vbs
- <Drive name for removable media>:\nyboy.bat
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks execution of the following system utilities:
- Registry Editor (RegEdit)
modifies the following system settings:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayContextMenu' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoNetHood' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetTaskbar' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFavoritesMenu' = '00000001'
Launches a large number of processes
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\notepad.exe
the following user processes:
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\~6722792875003177280~\sg.tmp
- D:\panda.vbs
- C:\nyboy.bat
- D:\nyboy.bat
- %TEMP%\42ba.tmp\42bb.tmp\42bc.bat
- %TEMP%\5e07.tmp\5e08.tmp\5e09.bat
- %TEMP%\8b3e.tmp\8b3f.tmp\8b50.bat
- %TEMP%\8ce3.tmp\8ce4.tmp\8ce5.bat
- %TEMP%\~1885365404620527869\bantaskmanager.exe
- %TEMP%\8e0c.tmp\8e0d.tmp\8e2d.bat
- %TEMP%\97fa.tmp\97fb.tmp\980c.bat
- %TEMP%\9829.tmp\9849.tmp\986a.bat
- %TEMP%\9990.tmp\9991.tmp\9992.bat
- %TEMP%\9a1c.tmp\9a1d.tmp\9a2e.bat
- %TEMP%\9ac8.tmp\9ac9.tmp\9aca.bat
- %TEMP%\9b54.tmp\9b55.tmp\9b56.bat
- %TEMP%\9d48.tmp\9d49.tmp\9d59.bat
- %TEMP%\fd9f.tmp\fda0.tmp\fda1.bat
- C:\panda.vbs
- %TEMP%\ef7c.tmp\ef7d.tmp\f0c6.bat
- %TEMP%\ee73.tmp\ee84.tmp\eed3.bat
- %TEMP%\eb29.tmp\eb2a.vbs
- %TEMP%\~1885365404620527869\delreg.bat
- %TEMP%\~1885365404620527869\delsystem32.bat
- %TEMP%\~1885365404620527869\icon.ico
- %TEMP%\~1885365404620527869\lbw.jpg
- %TEMP%\~1885365404620527869\lubenweinb.mp3
- %TEMP%\~1885365404620527869\panda.vbs
- %TEMP%\~1885365404620527869\run2.bat
- %TEMP%\9fd7.tmp\9fd8.tmp\9fd9.bat
- %TEMP%\92cc.tmp\92cd.tmp\92ce.bat
- %TEMP%\~1885365404620527869\welcome.txt
- %TEMP%\~1885365404620527869\delc.exe
- %TEMP%\~1885365404620527869\openpicture.exe
- %TEMP%\~1885365404620527869\run.exe
- %TEMP%\~1885365404620527869\startcolor.exe
- %TEMP%\~1885365404620527869\startmagnify.exe
- %TEMP%\~1885365404620527869\startmusic.exe
- %TEMP%\e8b9.tmp\e8ba.tmp\e8bb.bat
- %TEMP%\~1885365404620527869\circulate.bat
- %TEMP%\~1885365404620527869\color.exe
- %TEMP%\a15d.tmp\a16d.tmp\a16e.bat
Sets the 'hidden' attribute to the following files
- %TEMP%\~1885365404620527869\bantaskmanager.exe
- %TEMP%\~1885365404620527869\startmagnify.exe
- %TEMP%\~1885365404620527869\startcolor.exe
- %TEMP%\~1885365404620527869\run2.bat
- %TEMP%\~1885365404620527869\run.exe
- %TEMP%\~1885365404620527869\panda.vbs
- %TEMP%\~1885365404620527869\openpicture.exe
- %TEMP%\~1885365404620527869\startmusic.exe
- %TEMP%\~1885365404620527869\lubenweinb.mp3
- %TEMP%\~1885365404620527869\icon.ico
- %TEMP%\~1885365404620527869\delsystem32.bat
- %TEMP%\~1885365404620527869\delreg.bat
- %TEMP%\~1885365404620527869\delc.exe
- %TEMP%\~1885365404620527869\color.exe
- %TEMP%\~1885365404620527869\circulate.bat
- %TEMP%\~1885365404620527869\lbw.jpg
- %TEMP%\~1885365404620527869\welcome.txt
Deletes the following files
- %TEMP%\~6722792875003177280~\sg.tmp
- %TEMP%\e8b9.tmp\e8ba.tmp\e8bb.bat
- %TEMP%\ee73.tmp\ee84.tmp\eed3.bat
- %TEMP%\ef7c.tmp\ef7d.tmp\f0c6.bat
- %TEMP%\fd9f.tmp\fda0.tmp\fda1.bat
- %TEMP%\42ba.tmp\42bb.tmp\42bc.bat
- %TEMP%\5e07.tmp\5e08.tmp\5e09.bat
Miscellaneous
Searches for the following windows
- ClassName: 'WMPlayerApp' WindowName: ''
Creates and executes the following
- '%TEMP%\~6722792875003177280~\sg.tmp' x "<Full path to file>" -y -aoa -o"%TEMP%\~1885365404620527869"
- '%TEMP%\~1885365404620527869\run.exe'
- '%TEMP%\~1885365404620527869\color.exe'
- '%TEMP%\~1885365404620527869\startmusic.exe'
- '%TEMP%\~1885365404620527869\openpicture.exe'
- '%TEMP%\~1885365404620527869\startcolor.exe'
- '%TEMP%\~1885365404620527869\startmagnify.exe'
- '<SYSTEM32>\wscript.exe' %TEMP%\EB29.tmp\EB2A.vbs
- '<SYSTEM32>\wscript.exe' "%TEMP%\~1885365404620527869\Panda.vbs"
- '%TEMP%\~6722792875003177280~\sg.tmp' x "<Full path to file>" -y -aoa -o"%TEMP%\~1885365404620527869"' (with hidden window)
- '<SYSTEM32>\wscript.exe' %TEMP%\EB29.tmp\EB2A.vbs' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c set' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\FD9F.tmp\FDA0.tmp\FDA1.bat %TEMP%\~1885365404620527869\StartMagnify.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EE73.tmp\EE84.tmp\EED3.bat %TEMP%\~1885365404620527869\StartColor.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\42BA.tmp\42BB.tmp\42BC.bat %TEMP%\~1885365404620527869\StartMagnify.exe"' (with hidden window)
- '%TEMP%\~1885365404620527869\run.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\5E07.tmp\5E08.tmp\5E09.bat %TEMP%\~1885365404620527869\StartMagnify.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c set
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\C561.tmp\C562.tmp\C563.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\CD3D.tmp\CD3E.tmp\CD3F.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\CA8F.tmp\CA90.tmp\CA91.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\C966.tmp\C977.tmp\C978.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\C81F.tmp\C820.tmp\C821.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\C5CE.tmp\C5CF.tmp\C5EF.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B4CD.tmp\B4CE.tmp\B4CF.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\C35E.tmp\C35F.tmp\C360.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\BE4F.tmp\BE50.tmp\BE51.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\BB05.tmp\BB06.tmp\BB45.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\BAB7.tmp\BAB8.tmp\BAB9.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\BA3A.tmp\BA3B.tmp\BA4B.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\B8D3.tmp\B8E4.tmp\B8E5.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B7CA.tmp\B7CB.tmp\B7CC.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\C0CF.tmp\C0D0.tmp\C0D1.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\B50C.tmp\B50D.tmp\B50E.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\D1BF.tmp\D1E0.tmp\D1F0.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\E243.tmp\E244.tmp\E245.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\F028.tmp\F0B5.tmp\F0B6.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\F086.tmp\F086.tmp\F097.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\F085.tmp\F0A6.tmp\F0A7.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\ED4B.tmp\ED4C.tmp\ED4D.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EA4E.tmp\EA4F.tmp\EA60.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\E59D.tmp\E59E.tmp\E59F.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\D317.tmp\D327.tmp\D328.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\D384.tmp\D385.tmp\D386.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\E178.tmp\E179.tmp\E17A.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\E09E.tmp\E09F.tmp\E0A0.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\DD92.tmp\DD93.tmp\DD94.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\DCF6.tmp\DCF7.tmp\DCF8.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\D401.tmp\D402.tmp\D403.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\D603.tmp\D604.tmp\D605.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\E520.tmp\E521.tmp\E532.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B125.tmp\B136.tmp\B137.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B02C.tmp\B02D.tmp\B02E.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\B03B.tmp\B03C.tmp\B03D.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c echo [AutoRun]>><Drive name for removable media>:\autorun.inf&& echo open=NYboy.bat >><Drive name for removable media>:\autorun.inf&& echo shellexecute=NYboy.bat >><Drive name for removable ...
- '<SYSTEM32>\cmd.exe' /K circulate.bat
- '<SYSTEM32>\cmd.exe' /K DELreg.bat
- '<SYSTEM32>\cmd.exe' /K DELSystem32.bat
- '<SYSTEM32>\cmd.exe' /c echo [AutoRun]>>E:\autorun.inf&& echo open=NYboy.bat >>E:\autorun.inf&& echo shellexecute=NYboy.bat >>E:\autorun.inf&& echo shell\Auto\command=NYboy.bat>>E:\autorun.inf&& echo shell=Auto>>E:...
- '<SYSTEM32>\cmd.exe' /c attrib +h +s +r C:\NYboy.bat&& attrib +h +s +r D:\NYboy.bat&& attrib +h +s +r E:\NYboy.bat&& attrib +h +s +r <Drive name for removable media>:\NYboy.bat&& attrib +h +s +r I:\NYboy.bat
- '<SYSTEM32>\cmd.exe' /c echo [AutoRun]>>D:\autorun.inf&& echo open=NYboy.bat >>D:\autorun.inf&& echo shellexecute=NYboy.bat >>D:\autorun.inf&& echo shell\Auto\command=NYboy.bat>>D:\autorun.inf&& echo shell=Auto>>D:...
- '<SYSTEM32>\cmd.exe' /c echo [AutoRun]>>C:\autorun.inf&& echo open=NYboy.bat >>C:\autorun.inf&& echo shellexecute=NYboy.bat >>C:\autorun.inf&& echo shell\Auto\command=NYboy.bat>>C:\autorun.inf&& echo shell=Auto>>C:...
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\FD9F.tmp\FDA0.tmp\FDA1.bat %TEMP%\~1885365404620527869\StartMagnify.exe"
- '<SYSTEM32>\cmd.exe' /K run2.bat
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EE73.tmp\EE84.tmp\EED3.bat %TEMP%\~1885365404620527869\StartColor.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EF7C.tmp\EF7D.tmp\F0C6.bat %TEMP%\~1885365404620527869\OpenPicture.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\E8B9.tmp\E8BA.tmp\E8BB.bat %TEMP%\~1885365404620527869\RUN.exe"
- '<SYSTEM32>\notepad.exe' %TEMP%\~1885365404620527869\Welcome.txt
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\42BA.tmp\42BB.tmp\42BC.bat %TEMP%\~1885365404620527869\StartMagnify.exe"
- '<SYSTEM32>\cmd.exe' /c echo [AutoRun]>>I:\autorun.inf&& echo open=NYboy.bat >>I:\autorun.inf&& echo shellexecute=NYboy.bat >>I:\autorun.inf&& echo shell\Auto\command=NYboy.bat>>I:\autorun.inf&& echo shell=Auto>>I:...
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\5E07.tmp\5E08.tmp\5E09.bat %TEMP%\~1885365404620527869\StartMagnify.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\ADDB.tmp\ADDC.tmp\ADDD.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\9990.tmp\9991.tmp\9992.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\A15D.tmp\A16D.tmp\A16E.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\9FD7.tmp\9FD8.tmp\9FD9.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\9D48.tmp\9D49.tmp\9D59.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\9B54.tmp\9B55.tmp\9B56.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\9AC8.tmp\9AC9.tmp\9ACA.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\9A1C.tmp\9A1D.tmp\9A2E.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\9829.tmp\9849.tmp\986A.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\magnify.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\97FA.tmp\97FB.tmp\980C.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\92CC.tmp\92CD.tmp\92CE.bat %TEMP%\~1885365404620527869\Color.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\8E0C.tmp\8E0D.tmp\8E2D.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\utilman.exe' /debug
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\8CE3.tmp\8CE4.tmp\8CE5.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\8B3E.tmp\8B3F.tmp\8B50.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B27.tmp\B37.tmp\B38.bat %TEMP%\~1885365404620527869\Color.exe"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\D68.tmp\D69.tmp\D6A.bat %TEMP%\~1885365404620527869\Color.exe"
