Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Updates' = '%HOMEPATH%\s4t4n\s4t4n.vbe'
Creates the following files on removable media
- <Drive name for removable media>:\nouveau dossier.lnk
- <Drive name for removable media>:\autorun.inf
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
blocks the following features:
- User Account Control (UAC)
modifies the following system settings:
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
Modifies file system
Creates the following files
- %TEMP%\tmp.bat
- %TEMP%\tmp.vbe
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\autorun.inf
Deletes the following files
- %TEMP%\tmp.bat
- %TEMP%\tmp.vbe
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\nouveau dossier.lnk
Substitutes the following files
- %TEMP%\tmp.bat
- <Drive name for removable media>:\nouveau dossier.lnk
- <Drive name for removable media>:\autorun.inf
Network activity
Connects to
- 'lo####.0fees.net':80
UDP
- DNS ASK lo####.0fees.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\tmp.vbe"
Executes the following
- '<SYSTEM32>\cmd.exe' /K CD/D %HOMEPATH%\COOKIES & Del/f/q *.* & EXIT
- '<SYSTEM32>\cmd.exe' /K cd/d "%HOMEPATH%\Application Data\Skype" & rd/s/q "%HOMEPATH%\Application Data\Skype" & EXIT
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmp.bat" "
- '<SYSTEM32>\reg.exe' add "HKCU\software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskmgr" /t "REG_DWORD" /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "Updates" /t "REG_SZ" /d "%HOMEPATH%\s4t4n\s4t4n.vbe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t "REG_DWORD" /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\software\microsoft\windows\currentversion\policies\system" /v "consentpromptbehavioradmin" /t "REG_DWORD" /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKCU\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t "REG_DWORD" /d 2 /f
- '<SYSTEM32>\xcopy.exe' /Y /H "%HOMEPATH%\s4t4n\*.vbe" "%TEMP%\"
- '<SYSTEM32>\xcopy.exe' /Y /H "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.vbe" "%TEMP%\"
- '<SYSTEM32>\xcopy.exe' /Y /H "<SYSTEM32>\<File name>.vbe" "%TEMP%\"
- '<SYSTEM32>\attrib.exe' -s -h "%TEMP%\<File name>.vbe"
- '<SYSTEM32>\cmd.exe' /K CD/D %HOMEPATH%\COOKIES & Del/f/q *.* & EXIT' (with hidden window)
- '<SYSTEM32>\cmd.exe' /K cd/d "%HOMEPATH%\Application Data\Skype" & rd/s/q "%HOMEPATH%\Application Data\Skype" & EXIT' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmp.bat" "' (with hidden window)
- '<SYSTEM32>\wscript.exe' "%TEMP%\tmp.vbe"' (with hidden window)
