Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\catsrvps.url
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe
Modifies file system
Creates the following files
- %HOMEPATH%\catsrvps\catsrvps.vbs
- %HOMEPATH%\catsrvps\pktmon.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\6d4-0\mscorlib.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll.aux.tmp
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\8e0-0\system.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\system\1be7a15b1f33bf22e4f53aaf45518c77\system.ni.dll.aux.tmp
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\e48-0\system.core.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.core\eb4cca4f06a15158c3f7e2c56516729b\system.core.ni.dll.aux.tmp
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\f34-0\windowsbase.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\windowsbase\9a2107b30cbb02ca475f58ed046eff63\windowsbase.ni.dll.aux.tmp
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\c5c-0\presentationcore.dll
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentationcore\d7a637fdf68801e37fc897b530f9a8a6\presentationcore.ni.dll.aux.tmp
Moves the following files
- from %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\6d4-0\mscorlib.dll to %WINDIR%\assembly\nativeimages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll
- from %WINDIR%\assembly\nativeimages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll.aux.tmp to %WINDIR%\assembly\nativeimages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll.aux
- from %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\8e0-0\system.dll to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system\1be7a15b1f33bf22e4f53aaf45518c77\system.ni.dll
- from %WINDIR%\assembly\nativeimages_v4.0.30319_32\system\1be7a15b1f33bf22e4f53aaf45518c77\system.ni.dll.aux.tmp to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system\1be7a15b1f33bf22e4f53aaf45518c77\system.ni.dll.aux
- from %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\e48-0\system.core.dll to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.core\eb4cca4f06a15158c3f7e2c56516729b\system.core.ni.dll
- from %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.core\eb4cca4f06a15158c3f7e2c56516729b\system.core.ni.dll.aux.tmp to %WINDIR%\assembly\nativeimages_v4.0.30319_32\system.core\eb4cca4f06a15158c3f7e2c56516729b\system.core.ni.dll.aux
- from %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\f34-0\windowsbase.dll to %WINDIR%\assembly\nativeimages_v4.0.30319_32\windowsbase\9a2107b30cbb02ca475f58ed046eff63\windowsbase.ni.dll
- from %WINDIR%\assembly\nativeimages_v4.0.30319_32\windowsbase\9a2107b30cbb02ca475f58ed046eff63\windowsbase.ni.dll.aux.tmp to %WINDIR%\assembly\nativeimages_v4.0.30319_32\windowsbase\9a2107b30cbb02ca475f58ed046eff63\windowsbase.ni.dll.aux
- from %WINDIR%\assembly\nativeimages_v4.0.30319_32\temp\c5c-0\presentationcore.dll to %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentationcore\d7a637fdf68801e37fc897b530f9a8a6\presentationcore.ni.dll
- from %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentationcore\d7a637fdf68801e37fc897b530f9a8a6\presentationcore.ni.dll.aux.tmp to %WINDIR%\assembly\nativeimages_v4.0.30319_32\presentationcore\d7a637fdf68801e37fc897b530f9a8a6\presentationcore.ni.dll.aux
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 210 -InterruptEvent 0 -NGENProcess 150 -Pipe 17c -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 288 -InterruptEvent 0 -NGENProcess 294 -Pipe 254 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 254 -InterruptEvent 0 -NGENProcess 288 -Pipe 290 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 290 -InterruptEvent 0 -NGENProcess 254 -Pipe 270 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 270 -InterruptEvent 0 -NGENProcess 254 -Pipe 274 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 274 -InterruptEvent 0 -NGENProcess 270 -Pipe 268 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 268 -InterruptEvent 0 -NGENProcess 274 -Pipe 26c -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regsvcs.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 26c -InterruptEvent 0 -NGENProcess 268 -Pipe 230 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 230 -InterruptEvent 0 -NGENProcess 26c -Pipe 240 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 1b4 -InterruptEvent 0 -NGENProcess 228 -Pipe 294 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 240 -InterruptEvent 0 -NGENProcess 230 -Pipe 264 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 254 -InterruptEvent 0 -NGENProcess 230 -Pipe 258 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 230 -InterruptEvent 0 -NGENProcess 234 -Pipe 22c -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 22c -InterruptEvent 0 -NGENProcess 224 -Pipe 220 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 228 -InterruptEvent 0 -NGENProcess 220 -Pipe 1f4 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 224 -InterruptEvent 0 -NGENProcess 1f4 -Pipe 20c -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 220 -InterruptEvent 0 -NGENProcess 20c -Pipe 210 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 1f4 -InterruptEvent 0 -NGENProcess 210 -Pipe 140 -Comment "NGen Worker Process"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "start <Full path to file>" -verb runas
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 210 -InterruptEvent 0 -NGENProcess 214 -Pipe 178 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 264 -InterruptEvent 0 -NGENProcess 240 -Pipe 260 -Comment "NGen Worker Process"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe' -StartupEvent 280 -InterruptEvent 0 -NGENProcess 288 -Pipe 228 -Comment "NGen Worker Process"
