Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'NSIS64' = '%ProgramFiles%\javasuppot\msn.exe'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
modifies the following system settings:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
Modifies file system
Creates the following files
- %TEMP%\compress0\ass.dll
- %TEMP%\compress0\scint2.dll
- %TEMP%\compress0\scloc.dll
- %TEMP%\compress0\seek.dll
- %TEMP%\compress0\seekil.dll
- %TEMP%\compress0\services.exe
- %TEMP%\compress0\ssap.dll
- %TEMP%\compress0\svers.dll
- %TEMP%\compress0\type.dll
- %TEMP%\compress0\unin.dll
- %TEMP%\compress0\unir.exe
- %TEMP%\compress0\update.dll
- %TEMP%\compress0\user.dll
- %TEMP%\compress0\ushost.dll
- %TEMP%\compress0\mailsc.dll
- %TEMP%\compress0\weben.dll
- %TEMP%\compress0\ziplog.txt
- %ProgramFiles%\javasuppot\services.exe
- %ProgramFiles%\javasuppot\cmss.exe
- %ProgramFiles%\javasuppot\msn.exe
- %WINDIR%\svers.dll
- %WINDIR%\netcox.exe
- %WINDIR%\refsdm.dll
- %WINDIR%\ziplog.txt
- %WINDIR%\hpserv.dll
- <SYSTEM32>\mswinsck.ocx
- %ProgramFiles%\accessories\common\desktop.ini
- %ProgramFiles%\accessories\common\log.txt
- %ProgramFiles%\accessories\common\onlinetime.txt
- %TEMP%\compress0\scen.dll
- %TEMP%\compress0\scint.dll
- %TEMP%\compress0\scday.dll
- %TEMP%\compress0\sccle.dll
- %TEMP%\compress0\scan.dll
- %TEMP%\compress0\dete.dll
- %TEMP%\compress0\dunin.dll
- %TEMP%\compress0\ftde.dll
- %TEMP%\compress0\ften.dll
- %TEMP%\compress0\ftpa.dll
- %TEMP%\compress0\ftps.dll
- %TEMP%\compress0\ftsv.dll
- %TEMP%\compress0\ftus.dll
- %TEMP%\compress0\hpserv.dll
- %TEMP%\compress0\inmsg.dll
- %TEMP%\compress0\inter.dll
- %TEMP%\compress0\inuser.dll
- %TEMP%\compress0\mail.dll
- %ProgramFiles%\accessories\common\websitessummary.txt
- %TEMP%\compress0\winsyst32.exe
- %TEMP%\compress0\mailkl.dll
- %TEMP%\compress0\mswinsck.ocx
- %TEMP%\compress0\ntrestore.exe
- %TEMP%\compress0\oem.dll
- %TEMP%\compress0\port.dll
- %TEMP%\compress0\pwhost.dll
- %TEMP%\compress0\refsdm.dll
- %TEMP%\compress0\resu.dll
- %TEMP%\compress0\rmdesk.dll
- %TEMP%\compress0\rvhost.dll
- %TEMP%\compress0\rvport.dll
- %TEMP%\compress0\rwce.dll
- %TEMP%\compress0\rwci.dll
- %TEMP%\compress0\rwcs.dll
- %TEMP%\compress0\delkl.dll
- %TEMP%\compress0\msn.exe
- %ProgramFiles%\accessories\common\websitesdetail.txt
Sets the 'hidden' attribute to the following files
- %WINDIR%\hpserv.dll
Deletes the following files
- %TEMP%\compress0\ass.dll
- %TEMP%\compress0\rwci.dll
- %TEMP%\compress0\rwcs.dll
- %TEMP%\compress0\scan.dll
- %TEMP%\compress0\sccle.dll
- %TEMP%\compress0\scday.dll
- %TEMP%\compress0\scen.dll
- %TEMP%\compress0\scint.dll
- %TEMP%\compress0\scint2.dll
- %TEMP%\compress0\scloc.dll
- %TEMP%\compress0\rvport.dll
- %TEMP%\compress0\rwce.dll
- %TEMP%\compress0\seek.dll
- %TEMP%\compress0\ssap.dll
- %TEMP%\compress0\svers.dll
- %TEMP%\compress0\type.dll
- %TEMP%\compress0\unin.dll
- %TEMP%\compress0\unir.exe
- %TEMP%\compress0\update.dll
- %TEMP%\compress0\user.dll
- %TEMP%\compress0\ushost.dll
- %TEMP%\compress0\weben.dll
- %TEMP%\compress0\seekil.dll
- %TEMP%\compress0\services.exe
- %TEMP%\compress0\rvhost.dll
- %TEMP%\compress0\rmdesk.dll
- %TEMP%\compress0\resu.dll
- %TEMP%\compress0\dete.dll
- %TEMP%\compress0\dunin.dll
- %TEMP%\compress0\ftde.dll
- %TEMP%\compress0\ften.dll
- %TEMP%\compress0\ftpa.dll
- %TEMP%\compress0\ftps.dll
- %TEMP%\compress0\ftsv.dll
- %TEMP%\compress0\ftus.dll
- %TEMP%\compress0\hpserv.dll
- %TEMP%\compress0\inmsg.dll
- %TEMP%\compress0\delkl.dll
- %TEMP%\compress0\inter.dll
- %TEMP%\compress0\mail.dll
- %TEMP%\compress0\mailkl.dll
- %TEMP%\compress0\mailsc.dll
- %TEMP%\compress0\msn.exe
- %TEMP%\compress0\mswinsck.ocx
- %TEMP%\compress0\ntrestore.exe
- %TEMP%\compress0\oem.dll
- %TEMP%\compress0\port.dll
- %TEMP%\compress0\pwhost.dll
- %TEMP%\compress0\refsdm.dll
- %TEMP%\compress0\inuser.dll
- %TEMP%\compress0\winsyst32.exe
- %TEMP%\compress0\ziplog.txt
Network activity
Connects to
- '67.##5.111.54':37
- '67.##5.111.54':14001
Miscellaneous
Searches for the following windows
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
- ClassName: 'IEFrame' WindowName: ''
Creates and executes the following
- '%TEMP%\compress0\ntrestore.exe'
- '%ProgramFiles%\javasuppot\msn.exe'
- '%ProgramFiles%\javasuppot\services.exe'
- '%ProgramFiles%\javasuppot\cmss.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c echo y| CACLS C:\PROGRA~1\JAVASU~1 /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo y"
- '%WINDIR%\syswow64\cacls.exe' C:\PROGRA~1\JAVASU~1 /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y| CACLS C:\PROGRA~1\ACCESS~1\Common /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' C:\PROGRA~1\ACCESS~1\Common /G Everyone:f
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles%\javasuppot\servic...
- '%WINDIR%\syswow64\cmd.exe' /c echo y| CACLS C:\PROGRA~1\JAVASU~1 /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y| CACLS C:\PROGRA~1\ACCESS~1\Common /G Everyone:f' (with hidden window)
