Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{GcR832A-VrS135-8y7oK3k-n0TrC-3t4D2025}] 'StubPath' = '%APPDATA%\Microsoft\SystemCertificates\My\CTLs\R60321Z.pif'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Th3363-b357281-5rV23w-m0rF-K3k07}] 'StubPath' = '%WINDIR%\Help\R78452Z.pif'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\WinLogon] 'Shell' = 'Explorer.exe ...
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{3t4D2025-n0TrC-8y7oK3k-VrS135-GcR832A}] 'StubPath' = '%APPDATA%\Microsoft\SystemCertificates\My\CTLs\R60321Z.pif'
- [HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{K3k07-m0rF-5rV23w-b357281-Th3363}] 'StubPath' = '%WINDIR%\Help\R78452Z.pif'
Creates or modifies the following files
- %WINDIR%\tasks\at1.job
- <SYSTEM32>\tasks\at1
Creates the following files on removable media
- <Drive name for removable media>:\shortcut to user's documents.exe
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
blocks execution of the following system utilities:
- Command Prompt (CMD)
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
modifies the following system settings:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM AVWIN.EXE /IM AVGNT.EXE /IM AVGUARD.EXE /IM SYSAFE.EXE /IM NVCOD.EXE /IM ZLCLIENT.EXE /IM KAVSVC.EXE /IM MCAGENT.EXE /IM MGHTML.EXE /IM PCCMAIN.EXE /IM PCCVSCAN.EXE /IM PCCGUIDE.EXE /IM ...
Launches a large number of processes
Modifies file system
Creates the following files
- %APPDATA%\microsoft\systemcertificates\my\crls\about.ini
- %WINDIR%\system\notepad.pif
- %WINDIR%\syswow64\notepad.pif
- %WINDIR%\default_.pif
- %WINDIR%\ping.pif
- %WINDIR%\command.pif
- %WINDIR%\regedit.pif
- %WINDIR%\system\msconfig.pif
- %WINDIR%\system\sysedit.pif
- %WINDIR%\syswow64\ping.pif
- %WINDIR%\syswow64\taskkill.pif
- %WINDIR%\java\sun\j2re1.4.2\bin\lib\msvbvm60.dll
- %WINDIR%\syswow64\gpedit.pif
- %WINDIR%\syswow64\cmd.pif
- %WINDIR%\syswow64\sysedit.pif
- %WINDIR%\java\classes\setup952.exe
- %WINDIR%\java\classes\java633.exe
- %WINDIR%\help\intpub753.exe
- %WINDIR%\java\sun\j2re1.4.2\bin\lib\r95771z.exe
- %WINDIR%\help\r78452z.pif
- %APPDATA%\microsoft\systemcertificates\my\ctls\r60321z.pif
- %APPDATA%\microsoft\systemcertificates\my\crls\smtp161.exe
- %APPDATA%\microsoft\systemcertificates\my\crls\tftp94.exe
- %WINDIR%\syswow64\command.pif
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
Sets the 'hidden' attribute to the following files
- %WINDIR%\help\r78452z.pif
- %WINDIR%\syswow64\notepad.pif
- %WINDIR%\default_.pif
- %WINDIR%\ping.pif
- %WINDIR%\command.pif
- %WINDIR%\regedit.pif
- %WINDIR%\system\msconfig.pif
- %WINDIR%\system\sysedit.pif
- %WINDIR%\system\notepad.pif
- %WINDIR%\syswow64\ping.pif
- %WINDIR%\syswow64\gpedit.pif
- %WINDIR%\syswow64\command.pif
- %WINDIR%\syswow64\cmd.pif
- %WINDIR%\syswow64\sysedit.pif
- %WINDIR%\java\classes\java633.exe
- %WINDIR%\help\intpub753.exe
- %WINDIR%\java\sun\j2re1.4.2\bin\lib\r95771z.exe
- %WINDIR%\syswow64\taskkill.pif
- %WINDIR%\java\sun\j2re1.4.2\bin\lib\msvbvm60.dll
Deletes the following files
- %WINDIR%\tasks\at1.job
- <SYSTEM32>\tasks\at1
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'ExploreWClass' WindowName: ''
- ClassName: 'CabinetWClass' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'WorkerW' WindowName: ''
- ClassName: 'ReBarWindow32' WindowName: ''
- ClassName: 'ComboBoxEx32' WindowName: ''
- ClassName: 'ComboBox' WindowName: ''
- ClassName: 'Edit' WindowName: ''
Creates and executes the following
- '%APPDATA%\microsoft\systemcertificates\my\crls\tftp94.exe'
- '%APPDATA%\microsoft\systemcertificates\my\crls\smtp161.exe'
- '%WINDIR%\help\intpub753.exe'
Executes the following
- '%WINDIR%\syswow64\explorer.exe' <Current directory>\
- '%WINDIR%\syswow64\taskkill.exe' /F /IM AVWIN.EXE /IM AVGNT.EXE /IM AVGUARD.EXE /IM SYSAFE.EXE /IM NVCOD.EXE /IM ZLCLIENT.EXE /IM KAVSVC.EXE /IM MCAGENT.EXE /IM MGHTML.EXE /IM PCCMAIN.EXE /IM PCCVSCAN.EXE /IM PCCGUIDE.EXE /IM ...' (with hidden window)
- '%APPDATA%\microsoft\systemcertificates\my\crls\tftp94.exe' ' (with hidden window)
- '%APPDATA%\microsoft\systemcertificates\my\crls\smtp161.exe' ' (with hidden window)
- '%WINDIR%\help\intpub753.exe' ' (with hidden window)
