Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\software\Wow6432Node\microsoft\windows\CurrentVersion\Run] 'Lshuai' = '<Full path to file>'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\vhdmp] 'ImagePath' = 'system32\DRIVERS\vhdmp.sys'
- [HKLM\System\CurrentControlSet\Services\Disk] 'Start' = '00000000'
- [HKLM\System\CurrentControlSet\Services\volsnap] 'Start' = '00000000'
Creates the following services
- 'vhdmp' system32\DRIVERS\vhdmp.sys
- 'disk' system32\DRIVERS\disk.sys
- 'volsnap' system32\DRIVERS\volsnap.sys
Modifies file system
Creates the following files
- %TEMP%\12fa38.tmp
- %TEMP%\12fa37.tmp.vhd
- scsi#disk&ven_msft&prod_virtual_disk#2&1f4adffe&0&000001#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
- physicaldrive2
- globalroot\device\harddiskvolume5
- %TEMP%\12fa36.tmp\
Deletes the following files
- %TEMP%\12fa38.tmp
- %TEMP%\12fa37.tmp.vhd
Modifies the following files
- C:\system volume information\mountpointmanagerremotedatabase
Network activity
Connects to
- 'rm###########m4z470wio.mysql.rds.aliyuncs.com':3306
TCP
Other
- 'rm###########m4z470wio.mysql.rds.aliyuncs.com':3306
UDP
- DNS ASK rm###########m4z470wio.mysql.rds.aliyuncs.com
Miscellaneous
Searches for the following windows
- ClassName: 'DINotifyWindowClass853' WindowName: 'DINotifyWindowName853'
Creates and executes the following
- '%TEMP%\12fa36.tmp\'
Executes the following
- '%WINDIR%\syswow64\sc.exe' stop ShellHWDetection
- '%WINDIR%\syswow64\diskpart.exe' -s %TEMP%\12fa38.tmp
- '<SYSTEM32>\vds.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{ef6e744c-47f5-401a-9510-303a8992244c} "(null)"
- '<SYSTEM32>\dinotify.exe' pnpui.dll,SimplifiedDINotification
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{fef2e180-a68f-4038-8082-8b990c1848f2} "(null)"
- '%WINDIR%\syswow64\sc.exe' start ShellHWDetection
- '%WINDIR%\syswow64\sc.exe' stop ShellHWDetection' (with hidden window)
- '%WINDIR%\syswow64\diskpart.exe' -s %TEMP%\12fa38.tmp' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start ShellHWDetection' (with hidden window)
