Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'NVIDIA Media Center Library' = '%HOMEPATH%\user1\winlogon.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'NVIDIA Media Center Library' = '%HOMEPATH%\user1\winlogon.exe'
Creates the following files on removable media
- <Drive name for removable media>:\h3ojkih9lvfeffo0mg6hlxplglv3lyyuvhdarr3dtlhen80dniepqxqy2sziakx2axtns4sa044lspkbmnv9qm\s-4-7-01-4639107401-4494491267-104113574-7046\desktop.ini
- <Drive name for removable media>:\h3ojkih9lvfeffo0mg6hlxplglv3lyyuvhdarr3dtlhen80dniepqxqy2sziakx2axtns4sa044lspkbmnv9qm\s-4-7-01-4639107401-4494491267-104113574-7046\o7mrvq31rdbhh9hfkj9v0gt5z3...
- <Drive name for removable media>:\h3ojkih9lvfeffo0mg6hlxplglv3lyyuvhdarr3dtlhen80dniepqxqy2sziakx2axtns4sa044lspkbmnv9qm\o7mrvq31rdbhh9hfkj9v0gt5z3m2s5hp0.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
blocks the following features:
- System Restore (SR)
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %HOMEPATH%\user1\winlogon.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\604pwz7f\dnserrordiagoff_weboc[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\q1e129qo\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dzhkzdlo\errorpagestrings[1]
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\h3ojkih9lvfeffo0mg6hlxplglv3lyyuvhdarr3dtlhen80dniepqxqy2sziakx2axtns4sa044lspkbmnv9qm\s-4-7-01-4639107401-4494491267-104113574-7046\desktop.ini
- <Drive name for removable media>:\autorun.inf
Deletes the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\q1e129qo\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\604pwz7f\dnserrordiagoff_weboc[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dzhkzdlo\errorpagestrings[1]
Network activity
TCP
Other
- '34.##9.100.209':443
UDP
- DNS ASK wh##.amung.us
- DNS ASK 3-#############-r-y-7-g-b-3-8-9-8-4-l-j.cheaps1.info
- DNS ASK l-##############################c-a-f-s-0-7-1-1-7-u-6-b-5-a-l-.0-0-0-0-0-0-0-0-0-0-0-0-0-2-0-0-0-0-0-0-0-0-0-0-0-0-0.info
- DNS ASK z-##############################q-t-9-2-j-p-v-e-e-e-5-w-o-d-9-.rb-e-e3-j-fi-1-il-h-il-3e-z-u-r-u-lk-h-wm-3-6-g-0o-s-dx.info
- DNS ASK 5-##############################6-8-r-r-2-v-y-n-8-4-s-5-2-s-i-.z-hk-yl8-k-7o-8z-l-v-uhb-u-td-8i-oe-0gp-e2g-we6-ws-2vpd.info
- DNS ASK g-##############################x-w-d-q-7-0-7-w-w-b-l-b-6-8-5-.5-68-wk-5g-z2-pu6-e5x-4h-yij-yx-duv-wpx-2r8-7vc-ox-4q-u.info
- DNS ASK f-##############################s-0-t-y-t-8-o-i-2-1-h-9-c-1-p-.xz5-af-fj-o4-it-ok-n-9j-zjg-pz9x-1z-zekv-y4f-acg-cq3v-j.info
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'setup'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'IMWindowClass' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\user1\winlogon.exe'
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%HOMEPATH%\user1\winlogon.exe' ' (with hidden window)
