Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '6dje96wwdmo1' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Desktop Security' = '"%APPDATA%\Desktop Security\Desktop Security 2010.exe" /STARTUP'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SecurityCenter' = '%APPDATA%\Desktop Security\securitycenter.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Update
- Windows Security Center
Modifies file system
Creates the following files
- %TEMP%\qasccfe.tmp
- %TEMP%\_e39b.tmpac7d.exe
- %APPDATA%\desktop security\desktop security 2010.exe
- %APPDATA%\desktop security\securitycenter.exe
- %APPDATA%\desktop security\taskmgr.dll
- %APPDATA%\desktop security\securityhelper.exe
- %APPDATA%\microsoft\windows\start menu\programs\desktop security.lnk
- %APPDATA%\microsoft\windows\start menu\programs\desktop security\desktop security.lnk
- %APPDATA%\microsoft\windows\start menu\programs\desktop security\activate desktop security.lnk
- %APPDATA%\microsoft\windows\start menu\programs\desktop security\how to activate desktop security.lnk
- %APPDATA%\microsoft\windows\start menu\programs\desktop security\help desktop security.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\desktop security.lnk
- %TEMP%\qas165d.tmp
- %TEMP%\qas7b28.tmp
Deletes the following files
- %TEMP%\qasccfe.tmp
- %TEMP%\_e39b.tmpac7d.exe
- %TEMP%\qas165d.tmp
- %TEMP%\qas7b28.tmp
Network activity
UDP
- DNS ASK 17######02.httpdsconfig.com
- DNS ASK 17######03.httpdsconfig.com
- DNS ASK 17######21.httpdsconfig.com
- DNS ASK ht###high.in
- 'localhost':62475
- 'localhost':58843
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Desktop Security'
Creates and executes the following
- '%TEMP%\_e39b.tmpac7d.exe' -p"20:09" -y -o"%APPDATA%\Desktop Security"
- '%APPDATA%\desktop security\desktop security 2010.exe'
- '%APPDATA%\desktop security\securitycenter.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C dir "%APPDATA%"
- '%WINDIR%\syswow64\cmd.exe' /C dir "%APPDATA%\Desktop Security"
- '%TEMP%\_e39b.tmpac7d.exe' -p"20:09" -y -o"%APPDATA%\Desktop Security"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C dir "%APPDATA%"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C dir "%APPDATA%\Desktop Security"' (with hidden window)
