Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Policies' = '<SYSTEM32>\install\windowsexplorer.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Policies' = '<SYSTEM32>\install\windowsexplorer.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '<SYSTEM32>\install\windowsexplorer.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'windows' = '<SYSTEM32>\install\windowsexplorer.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{UC47N72P-3216-S56B-6N87-PNG8G4B5UDH1}] 'StubPath' = '<SYSTEM32>\install\windowsexplorer.exe Restart'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{UC47N72P-3216-S56B-6N87-PNG8G4B5UDH1}] 'StubPath' = '<SYSTEM32>\install\windowsexplorer.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\mini-kms_activator_v1.053.exe
- %TEMP%\fa17.tmp\kmsins.cmd
- %TEMP%\fa17.tmp\rearmof.cmd
- %TEMP%\fa17.tmp\rearmw.cmd
- %TEMP%\fa17.tmp\rest.cmd
- %TEMP%\fa17.tmp\help.txt
- %TEMP%\fa17.tmp\hs_message.vbs
- %TEMP%\fa17.tmp\ospp.vbs
- %TEMP%\fa17.tmp\autorun.apm
- %TEMP%\user7
- %TEMP%\459.exe
- %LOCALAPPDATA%\xenocode\appliancecaches\serverreal.exe_v0a6f9948\native\stubexe\@appdatalocal@\temp\459.exe
- %WINDIR%\syswow64\install\windowsexplorer.exe
- %TEMP%\user2.txt
- %LOCALAPPDATA%\xenocode\appliancecaches\serverreal.exe_v0a6f9948\native\stubexe\@system@\explorer.exe
- %LOCALAPPDATA%\xenocode\appliancecaches\serverreal.exe_v0a6f9948\native\stubexe\@programfiles@\opera\launcher.exe
- %APPDATA%\userlog.dat
- %TEMP%\fa17.tmp\keymngw.cmd
- %TEMP%\fa17.tmp\vl.vbs
- %TEMP%\fa17.tmp\keymngof.cmd
- %TEMP%\fa17.tmp\instsrv.exe
- %TEMP%\mini-kms_activator_v1.0530.exe
- %TEMP%\fa17.tmp\start.cmd
- %TEMP%\fa17.tmp\slerror.xml
- %TEMP%\fa17.tmp\autorun.exe
- %TEMP%\fa17.tmp\choice.exe
- %TEMP%\fa17.tmp\cscript.exe
- %TEMP%\fa17.tmp\hidcon.exe
- %TEMP%\fa17.tmp\kmservice.exe
- %TEMP%\fa17.tmp\chkof.cmd
- %TEMP%\fa17.tmp\ospprearm.exe
- %TEMP%\fa17.tmp\portqry.exe
- %TEMP%\fa17.tmp\srvany.exe
- %TEMP%\fa17.tmp\osppc.dll
- %TEMP%\fa17.tmp\service.inf
- %TEMP%\fa17.tmp\actof.cmd
- %TEMP%\fa17.tmp\actwin.cmd
- %TEMP%\fa17.tmp\chkwin.cmd
- %TEMP%\user8
Sets the 'hidden' attribute to the following files
- %APPDATA%\userlog.dat
Deletes the following files
- %TEMP%\user2.txt
- %TEMP%\user7
- %TEMP%\user8
Substitutes the following files
- %TEMP%\user7
- %TEMP%\user8
Network activity
Connects to
- 'se##er.com':80
UDP
- DNS ASK se##er.com
Miscellaneous
Creates and executes the following
- '%TEMP%\mini-kms_activator_v1.053.exe'
- '%TEMP%\mini-kms_activator_v1.0530.exe'
- '%TEMP%\fa17.tmp\cscript.exe' HS_MESSAGE.vbs "Did you run the program as Administrator? " "Activation Tool" Q YESNO
- '%LOCALAPPDATA%\xenocode\appliancecaches\serverreal.exe_v0a6f9948\native\stubexe\@appdatalocal@\temp\459.exe'
- '%LOCALAPPDATA%\xenocode\appliancecaches\serverreal.exe_v0a6f9948\native\stubexe\@system@\explorer.exe'
- '%LOCALAPPDATA%\xenocode\appliancecaches\serverreal.exe_v0a6f9948\native\stubexe\@programfiles@\opera\launcher.exe'
- '%WINDIR%\syswow64\install\windowsexplorer.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\FA17.tmp\Start.cmd" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\FA17.tmp\Start.cmd" "' (with hidden window)
- '%LOCALAPPDATA%\xenocode\appliancecaches\serverreal.exe_v0a6f9948\native\stubexe\@appdatalocal@\temp\459.exe' ' (with hidden window)
