Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\NGEN38630_32] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\NGEN38630_32] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\DisplaySwitch.exe'
Creates the following services
- 'NGEN38630_32' %ALLUSERSPROFILE%\Microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\DisplaySwitch.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\displayswitch.exe
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\winrmc.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\winrmf.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\slmgrl.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\winrmd.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\winrmy.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\slmgrn.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\stdole2v.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\qagents.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\rendezvoussessiong.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\rendezvoussessiont.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\msdatsrcv.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\msdatsrca.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\msscriptk.ocx
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\dmviewc.ocx
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\inetcply.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\telephonl.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\firewallw.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\mmsysg.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\wsmanconfig_schemaa.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\locationnotificationsvieww.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\locationnotificationsviewd.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\ndfeventviewl.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\ndfeventviewb.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\msdatsrcg.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\kbdfan.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\kbdarmec.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\accessibilitycpln.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\napdsnapl.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\rcx92ee.tmp
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\rcx92dd.tmp
- %TEMP%\tmp92dc.tmp
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\hhctrla.ocx
- nul
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\displayswitch.exe
Moves the following files
- from %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\rcx92dd.tmp to %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\displayswitch.exe
- from %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\rcx92ee.tmp to %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\displayswitch.exe
Deletes itself.
Network activity
Connects to
- '61.##.140.152':10204
- '61.##.208.123':10204
- '62.##2.163.50':10204
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__1133f62a58dcfd54\displayswitch.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "<Full path to file>" & del "<Full path to file>" > NUL & exit
- '%WINDIR%\syswow64\ping.exe' -n 2 127.0.0.1
- '%WINDIR%\syswow64\fsutil.exe' file setzerodata offset=0 length=524288 "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "<Full path to file>" & del "<Full path to file>" > NUL & exit' (with hidden window)
