Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\chm.file\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\regfile\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\hlpfile\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\txtfile\shell\open\command] '' = ''
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '"<SYSTEM32>\smss.exe:750234914.vbs"'
- [<HKLM>\SOFTWARE\Classes\inifile\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\inffile\shell\open\command] '' = ''
Creates the following files on removable media:
- <Drive name for removable media>:\AutoRun.inf
- <Drive name for removable media>:\1290004616.vbs
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Creates and executes the following:
- %WINDIR%\system\svchost.exe <SYSTEM32>\smss.exe:750234914.vbs
Executes the following:
- <SYSTEM32>\wscript.exe ""%TEMP%\~sfx00797E159C\1998182540.vbs""
Forces autoplay for removable media.
Modifies file system :
Creates the following files:
- C:\System Volume Information.lnk
- %WINDIR%.lnk
- C:\RECYCLER.lnk
- <Auxiliary element>
- %WINDIR%\explorer.exe:750234914.vbs
- <SYSTEM32>\dllcache\explorer.exe.new
- <SYSTEM32>\dllcache\smss.exe.new
- <SYSTEM32>\smss.exe:750234914.vbs
- %WINDIR%\system\svchost.exe
- C:\750234914.vbs
- C:\AutoRun.inf
- %TEMP%\~sfx00797E159C\123.exe
- %TEMP%\~sfx00797E159C\1998182540.vbs
- <Current directory>.lnk
- C:\<Auxiliary name>.lnk
- %PROGRAM_FILES%.lnk
- C:\Documents and Settings.lnk
- C:\Far.lnk
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\1290004616.vbs
- <Drive name for removable media>:\AutoRun.inf
- %WINDIR%\system\svchost.exe
- %TEMP%\~sfx00797E159C\1998182540.vbs
- C:\750234914.vbs
- C:\AutoRun.inf
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
