Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\wscsvc] 'start' = '00000001'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
blocks the following features:
- User Account Control (UAC)
Executes the following
- '%WINDIR%\syswow64\net.exe' stop "SDRSVC"
- '%WINDIR%\syswow64\net.exe' stop "wuauserv"
- '%WINDIR%\syswow64\net.exe' stop "mpssvc"
- '%WINDIR%\syswow64\net.exe' stop "WdNisSvc"
- '%WINDIR%\syswow64\net.exe' stop "Sense"
- '%WINDIR%\syswow64\net.exe' stop "SecurityHealthService"
- '%WINDIR%\syswow64\net.exe' stop "EventLog"
- '%WINDIR%\syswow64\net.exe' stop "WinDefend"
Modifies settings of Windows Internet Explorer
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000001'
Modifies file system
Creates the following files
- %TEMP%\nste198.tmp
- %WINDIR%\temp\tar418b.tmp
- %WINDIR%\temp\cab418a.tmp
- %WINDIR%\temp\tar2996.tmp
- %WINDIR%\temp\cab2995.tmp
- %WINDIR%\temp\tar1440.tmp
- %WINDIR%\temp\cab143f.tmp
- %WINDIR%\temp\tarff19.tmp
- %WINDIR%\temp\cabff18.tmp
- %WINDIR%\temp\cab41bb.tmp
- %WINDIR%\temp\tar4bfe.tmp
- %HOMEPATH%\desktop\gqmzpqm.html
- %HOMEPATH%\desktop\information.bat
- %HOMEPATH%\desktop\loopfile.bat
- %HOMEPATH%\desktop\b6 ransomware.bat
- C:\temp\matrix.bat
- C:\temp\winapply.bat
- C:\temp\ware.jpg
- %TEMP%\nsoe82e.tmp\nsexec.dll
- %WINDIR%\temp\cab4bfd.tmp
- %WINDIR%\temp\tar41bc.tmp
Deletes the following files
- %WINDIR%\temp\cab4bfd.tmp
- %WINDIR%\temp\tar4bfe.tmp
- %WINDIR%\temp\cabff18.tmp
- %WINDIR%\temp\tarff19.tmp
- %WINDIR%\temp\cab143f.tmp
- %WINDIR%\temp\tar1440.tmp
- %WINDIR%\temp\cab2995.tmp
- %WINDIR%\temp\tar2996.tmp
- %WINDIR%\temp\cab418a.tmp
- %WINDIR%\temp\tar418b.tmp
- %WINDIR%\temp\cab41bb.tmp
- %WINDIR%\temp\tar41bc.tmp
Network activity
Connects to
- 'ev######.ws.symantec.com':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://ev######.ws.symantec.com/evcs.crl
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt
UDP
- DNS ASK ev######.ws.symantec.com
- DNS ASK microsoft.com
- 'localhost':56828
- 'localhost':52166
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\net1.exe' stop "EventLog"
- '%WINDIR%\syswow64\wbem\wmic.exe' csproduct list brief /format:htable
- '%WINDIR%\syswow64\wbem\wmic.exe' service where state="running" get caption,name,pathname,state,status,acceptpause,acceptstop,processid,systemname,startname /format:htable
- '%WINDIR%\syswow64\wbem\wmic.exe' service where state="stopped" get caption,name,pathname,state,status,acceptpause,acceptstop,processid,systemname,startname /format:htable
- '%WINDIR%\syswow64\wbem\wmic.exe' volume list brief /format:htable
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu list brief /format:htable
- '%WINDIR%\syswow64\wbem\wmic.exe' diskdrive list brief /format:htable
- '%WINDIR%\syswow64\wbem\wmic.exe' OS get /format:hform
- '%WINDIR%\syswow64\wbem\wmic.exe' computersystem get /format:hform
- '%WINDIR%\syswow64\wbem\wmic.exe' product get name, version /format:htable
- '%WINDIR%\syswow64\wbem\wmic.exe' logicaldisk list brief /format:htable
- '%WINDIR%\syswow64\net1.exe' stop "WinDefend"
- '%WINDIR%\syswow64\cmd.exe' /c information.bat
- '%WINDIR%\syswow64\net1.exe' stop "wuauserv"
- '%WINDIR%\syswow64\net1.exe' stop "mpssvc"
- '%WINDIR%\syswow64\net1.exe' stop "WdNisSvc"
- '%WINDIR%\syswow64\net1.exe' stop "SDRSVC"
- '%WINDIR%\syswow64\net1.exe' stop "SecurityHealthService"
- '%WINDIR%\syswow64\wbem\wmic.exe' NICCONFIG list brief /format:htable
- '%WINDIR%\syswow64\net1.exe' stop "Sense"
- '%WINDIR%\syswow64\net.exe' stop "wuauserv"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "EventLog"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "WinDefend"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "SecurityHealthService"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "Sense"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "WdNisSvc"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "mpssvc"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "SDRSVC"' (with hidden window)
