Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qq.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OUTLOOK.EXE] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE] 'debugger' = '<SYSTEM32>\item.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icesword.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvp.exe] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplorerexe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icesword.exe] 'debugger' = '<SYSTEM32>\item.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\POWERPNT.EXE] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\service.msc] 'debugger' = '<SYSTEM32>\item.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinRAR.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acdsee.EXE] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IExplorer.exe] 'debugger' = '<SYSTEM32>\item.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe] 'debugger' = '<SYSTEM32>\item.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'winupdate' = '<SYSTEM32>\usbsetdll.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\usbset.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\usbsetdll.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'winupdate' = '<SYSTEM32>\usbsetdll.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegSrvc.exe] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\flash.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav.exe] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe] 'debugger' = '1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe] 'debugger' = '<SYSTEM32>\????(Ctrl+Alt+End).exe'
Creates the following files on removable media:
- <Drive name for removable media>:\AutoRun.inf
Malicious functions:
Executes the following:
- '<SYSTEM32>\attrib.exe' /pid=3068
- '<SYSTEM32>\attrib.exe' -p 2060 -e 128 -g
- '<SYSTEM32>\attrib.exe' /pid=3228
- '<SYSTEM32>\attrib.exe' /pid=4072
- '<SYSTEM32>\attrib.exe' /pid=4080
- '<SYSTEM32>\attrib.exe' /pid=3992
- '<SYSTEM32>\attrib.exe' /pid=3056
- '<SYSTEM32>\attrib.exe' -p 3384 -e 128 -g
- '<SYSTEM32>\attrib.exe' /pid=2064
- '<SYSTEM32>\attrib.exe' A:\????.exe +h +s +r +a
- '<SYSTEM32>\attrib.exe' /pid=3900
- '<SYSTEM32>\attrib.exe' /pid=1720
- '<SYSTEM32>\attrib.exe' /pid=3000
- '<SYSTEM32>\attrib.exe' /pid=2604
- '<SYSTEM32>\attrib.exe' /pid=2660
- '<SYSTEM32>\attrib.exe' /pid=2808
- '<SYSTEM32>\attrib.exe' /pid=328
- '<SYSTEM32>\attrib.exe' /pid=2912
- '<SYSTEM32>\attrib.exe' /pid=3260
- '<SYSTEM32>\attrib.exe' /pid=2964
- '<SYSTEM32>\attrib.exe' /pid=3724
- '<SYSTEM32>\attrib.exe' /pid=2872
- '<SYSTEM32>\attrib.exe' /pid=240
- '<SYSTEM32>\attrib.exe' C:\????.exe +h +s +r +a
- '<SYSTEM32>\attrib.exe' /pid=3784
- '<SYSTEM32>\attrib.exe' /pid=2836
- '<SYSTEM32>\attrib.exe' /pid=2852
- '<SYSTEM32>\attrib.exe' C:\AutoRun.inf +h +s +r +a
- '<SYSTEM32>\attrib.exe' A:\AutoRun.inf +h +s +r +a
- '<SYSTEM32>\attrib.exe' <SYSTEM32>\usbsetdll.exe +h +s +r +a
- '<SYSTEM32>\attrib.exe' Z:\????.exe +h +s +r +a
- '<SYSTEM32>\attrib.exe' <Drive name for removable media>:\AutoRun.ini +h +s +r +a
- '<SYSTEM32>\attrib.exe' %ALLUSERSPROFILE%\??????\??\??\usbsetdll.exe +h +s +r +a
- '<SYSTEM32>\attrib.exe' Z:\AutoRun.ini +h +s +r +a
- '<SYSTEM32>\attrib.exe' E:\AutoRun.inf +h +s +r +a
- '<SYSTEM32>\attrib.exe' <Drive name for removable media>:\AutoRun.inf +h +s +r +a
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\dllls.bat
- '<SYSTEM32>\attrib.exe' E:\AutoRun.ini +h +s +r +a
- '<SYSTEM32>\attrib.exe' C:\AutoRun.ini +h +s +r +a
- '<SYSTEM32>\attrib.exe' Z:\AutoRun.inf +h +s +r +a
- '<SYSTEM32>\attrib.exe' A:\AutoRun.ini +h +s +r +a
- '<SYSTEM32>\attrib.exe' /pid=3856
- '<SYSTEM32>\attrib.exe' /pid=3864
- '<SYSTEM32>\attrib.exe' /pid=3828
- '<SYSTEM32>\attrib.exe' /pid=3980
- '<SYSTEM32>\attrib.exe' /pid=3956
- '<SYSTEM32>\attrib.exe' /pid=3912
- '<SYSTEM32>\attrib.exe' /pid=3800
- '<SYSTEM32>\attrib.exe' E:\????.exe +h +s +r +a
- '<SYSTEM32>\attrib.exe' /c <SYSTEM32>\dllls.bat
- '<SYSTEM32>\attrib.exe' <Drive name for removable media>:\????.exe +h +s +r +a
- '<SYSTEM32>\attrib.exe' /pid=3772
- '<SYSTEM32>\attrib.exe' /pid=3756
- '<SYSTEM32>\attrib.exe' /pid=3744
Injects code into
the following system processes:
- <SYSTEM32>\attrib.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\dllls.bat
- C:\AutoRun.inf
- <SYSTEM32>\usbsetdll.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\usbsetdll.exe
- <Drive name for removable media>:\AutoRun.inf
Deletes the following files:
- C:\AutoRun.inf
