Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateManager' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateSvc' = '<Full path to file>'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsUpdateSvc' = '<Full path to file>'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateSvc' = '<Full path to file>'
Creates or modifies the following files
- <SYSTEM32>\tasks\windowssystemmonitorsvc
- <SYSTEM32>\tasks\windowsupdatesvc
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowsupdatesvc.exe
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinSysMon] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\WinSysMon] 'ImagePath' = '<Full path to file>'
Creates the following services
- 'WinSysMon' <Full path to file>
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
blocks the following features:
- System Restore (SR)
modifies the following system settings:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogoff' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = '03FFFFFF'
- [\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogoff' = '00000001'
- [\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = '03FFFFFF'
Modifies file system
Creates the following files
- %TEMP%\{ca503814-61d5-4907-b83d-5f6378b2b583}.png
- D:\system volume information\wpsettings.dat
- %LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{6a9c4dae-10b7-3fc9-6006-91cc8940257b}.png
- nul
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\windowsupdatesvc.exe
Deletes following files that it created itself
- %TEMP%\{ca503814-61d5-4907-b83d-5f6378b2b583}.png
- %LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{6a9c4dae-10b7-3fc9-6006-91cc8940257b}.png
Moves the following files
- from D:\system volume information\wpsettings.dat to D:\system volume information\wpsettings.dat.terentiy
Modifies the following files
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab
Miscellaneous
Searches for the following windows
- ClassName: 'Button' WindowName: 'Start'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /SC ONLOGON /RL HIGHEST /TN "WindowsUpdateSvc" /TR "<Full path to file>" /F >nul 2>&1
- '<SYSTEM32>\schtasks.exe' /Create /SC ONLOGON /RL HIGHEST /TN "WindowsUpdateSvc" /TR "<Full path to file>" /F
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /SC ONSTART /RL HIGHEST /RU SYSTEM /TN "WindowsSystemMonitorSvc" /TR "<Full path to file>" /F >nul 2>&1
- '<SYSTEM32>\schtasks.exe' /Create /SC ONSTART /RL HIGHEST /RU SYSTEM /TN "WindowsSystemMonitorSvc" /TR "<Full path to file>" /F
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /SC ONLOGON /RL HIGHEST /TN "WindowsUpdateSvc" /TR "<Full path to file>" /F >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /SC ONSTART /RL HIGHEST /RU SYSTEM /TN "WindowsSystemMonitorSvc" /TR "<Full path to file>" /F >nul 2>&1' (with hidden window)
