Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\seclogon] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\RpcSs] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SamSs] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Themes] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\winmgmt] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SENS] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ShellHWDetection] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\dmserver] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Dnscache] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\AudioSrv] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\DcomLaunch] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\PlugPlay] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ProtectedStorage] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Eventlog] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\lanmanworkstation] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '<SYSTEM32>\sc.exe' config WmdmPmSN start= DISABLED
- '<SYSTEM32>\sc.exe' config Wmi start= DEMAND
- '<SYSTEM32>\sc.exe' config WmiApSrv start= DISABLED
- '<SYSTEM32>\sc.exe' config W32Time start= DISABLED
- '<SYSTEM32>\sc.exe' config WebClient start= DISABLED
- '<SYSTEM32>\sc.exe' config winmgmt start= AUTO
- '<SYSTEM32>\sc.exe' config wuauserv start= DISABLED
- '<SYSTEM32>\sc.exe' config SSDPSRV start= DISABLED
- '<SYSTEM32>\sc.exe' config TlntSvr start= DISABLED
- '<SYSTEM32>\sc.exe' config upnphost start= DEMAND
- '<SYSTEM32>\sc.exe' config xmlprov start= DEMAND
- '<SYSTEM32>\sc.exe' config FastUserSwitchingCompatibility start= DEMAND
- '<SYSTEM32>\sc.exe' config srservice start= DISABLED
- '<SYSTEM32>\sc.exe' config stisvc start= DEMAND
- '<SYSTEM32>\sc.exe' config swprv start= DISABLED
- '<SYSTEM32>\sc.exe' config SysmonLog start= DISABLED
- '<SYSTEM32>\sc.exe' config SharedAccess start= DEMAND
- '<SYSTEM32>\sc.exe' config ShellHWDetection start= AUTO
- '<SYSTEM32>\sc.exe' config Spooler start= DEMAND
- '<SYSTEM32>\sc.exe' config TapiSrv start= DEMAND
- '<SYSTEM32>\sc.exe' config UMWdf start= DEMAND
- '<SYSTEM32>\sc.exe' config UPS start= DISABLED
- '<SYSTEM32>\sc.exe' config VSS start= DISABLED
- '<SYSTEM32>\sc.exe' config TermService start= DISABLED
- '<SYSTEM32>\sc.exe' config Themes start= AUTO
- '<SYSTEM32>\sc.exe' config TrkWks start= DISABLED
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v hkey /d HKLM
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v inimapping /d 0
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v item /d TINTSETP
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v key /d SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A"
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v command /d "<SYSTEM32>\IME\TINTLGNT\TINTSETP.EXE /IMEName"
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v key /d SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v inimapping /d 0
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v item /d TINTSETP
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v key /d SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync"
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v command /d ""%WINDIR%\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32"
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v hkey /d HKLM
- '<SYSTEM32>\reg.exe' add HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\new /ve /d {D969A300-E7FF-11d0-A93B-00A0C90F2719}
- '<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /va /f
- '<SYSTEM32>\sc.exe' config wscsvc start= DISABLED
- '<SYSTEM32>\regsvr32.exe' /u /s igfxpph.dll
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v ctfmon.exe /d <SYSTEM32>\ctfmon.exe
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v hkey /d HKLM
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v inimapping /d 0
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v item /d IMJPMIG
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1"
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v command /d ""%WINDIR%\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32"
- '<SYSTEM32>\sc.exe' config SENS start= AUTO
- '<SYSTEM32>\sc.exe' config ERSvc start= DISABLED
- '<SYSTEM32>\sc.exe' config Eventlog start= AUTO
- '<SYSTEM32>\sc.exe' config EventSystem start= DEMAND
- '<SYSTEM32>\sc.exe' config dmadmin start= DEMAND
- '<SYSTEM32>\sc.exe' config dmserver start= AUTO
- '<SYSTEM32>\sc.exe' config Dnscache start= AUTO
- '<SYSTEM32>\sc.exe' config helpsvc start= DISABLED
- '<SYSTEM32>\sc.exe' config lanmanserver start= DISABLED
- '<SYSTEM32>\sc.exe' config lanmanworkstation start= AUTO
- '<SYSTEM32>\sc.exe' config LmHosts start= DISABLED
- '<SYSTEM32>\sc.exe' config HidServ start= DISABLED
- '<SYSTEM32>\sc.exe' config HTTPFilter start= DEMAND
- '<SYSTEM32>\sc.exe' config ImapiService start= DISABLED
- '<SYSTEM32>\sc.exe' config AppMgmt start= DEMAND
- '<SYSTEM32>\sc.exe' config AudioSrv start= AUTO
- '<SYSTEM32>\sc.exe' config BITS start= DISABLED
- '<SYSTEM32>\cmd.exe' /c %TEMP%\158781.bat
- '<SYSTEM32>\sc.exe' config Alerter start= DISABLED
- '<SYSTEM32>\sc.exe' config ALG start= DISABLED
- '<SYSTEM32>\sc.exe' config Browser start= DISABLED
- '<SYSTEM32>\sc.exe' config CryptSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config DcomLaunch start= AUTO
- '<SYSTEM32>\sc.exe' config Dhcp start= DEMAND
- '<SYSTEM32>\sc.exe' config CiSvc start= DISABLED
- '<SYSTEM32>\sc.exe' config ClipSrv start= DISABLED
- '<SYSTEM32>\sc.exe' config COMSysApp start= DEMAND
- '<SYSTEM32>\sc.exe' config RasMan start= DEMAND
- '<SYSTEM32>\sc.exe' config RDSessMgr start= DISABLED
- '<SYSTEM32>\sc.exe' config remoteAccess start= DISABLED
- '<SYSTEM32>\sc.exe' config PolicyAgent start= DEMAND
- '<SYSTEM32>\sc.exe' config ProtectedStorage start= AUTO
- '<SYSTEM32>\sc.exe' config RasAuto start= DEMAND
- '<SYSTEM32>\sc.exe' config remoteRegistry start= DISABLED
- '<SYSTEM32>\sc.exe' config SCardSvr start= DISABLED
- '<SYSTEM32>\sc.exe' config Schedule start= AUTO
- '<SYSTEM32>\sc.exe' config seclogon start= AUTO
- '<SYSTEM32>\sc.exe' config RpcLocator start= DISABLED
- '<SYSTEM32>\sc.exe' config RpcSs start= AUTO
- '<SYSTEM32>\sc.exe' config SamSs start= AUTO
- '<SYSTEM32>\sc.exe' config MSIServer start= DEMAND
- '<SYSTEM32>\sc.exe' config NetDDE start= DISABLED
- '<SYSTEM32>\sc.exe' config NetDDEdsdm start= DISABLED
- '<SYSTEM32>\sc.exe' config Messenger start= DISABLED
- '<SYSTEM32>\sc.exe' config mnmsrvc start= DISABLED
- '<SYSTEM32>\sc.exe' config MSDTC start= DISABLED
- '<SYSTEM32>\sc.exe' config Netlogon start= DISABLED
- '<SYSTEM32>\sc.exe' config NtmsSvc start= DEMAND
- '<SYSTEM32>\sc.exe' config ose start= DISABLED
- '<SYSTEM32>\sc.exe' config PlugPlay start= AUTO
- '<SYSTEM32>\sc.exe' config Netman start= DEMAND
- '<SYSTEM32>\sc.exe' config Nla start= DISABLED
- '<SYSTEM32>\sc.exe' config NtLmSsp start= DISABLED
Modifies file system :
Creates the following files:
- %TEMP%\158781.bat
Deletes the following files:
- <SYSTEM32>\CatRoot2\edb0000D.log
- <SYSTEM32>\CatRoot2\edb0000E.log
- %WINDIR%\SoftwareDistribution\DataStore\Logs\res2.log
- <SYSTEM32>\CatRoot2\edb.log
- <SYSTEM32>\CatRoot2\edb0000F.log
- <SYSTEM32>\CatRoot2\edb00012.log
- <SYSTEM32>\CatRoot2\edb00013.log
- <SYSTEM32>\CatRoot2\edb00010.log
- <SYSTEM32>\CatRoot2\edb00011.log
- %WINDIR%\SoftwareDistribution\DataStore\Logs\res1.log
- %WINDIR%\pchealth\helpctr\Logs\hcupdate.log
- %WINDIR%\repair\setup.log
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.log
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
- %WINDIR%\security\logs\backup.log
- %WINDIR%\SoftwareDistribution\ReportingEvents.log
- %WINDIR%\SoftwareDistribution\DataStore\Logs\edb.log
- %WINDIR%\security\logs\SceRoot.log
- %WINDIR%\security\logs\scesetup.log
- <SYSTEM32>\wbem\Logs\wbemcore.log
- <SYSTEM32>\wbem\Logs\wbemess.log
- <SYSTEM32>\wbem\Logs\replog.log
- <SYSTEM32>\wbem\Logs\setup.log
- <SYSTEM32>\wbem\Logs\wbemprox.log
- %WINDIR%\SoftwareDistribution\DataStore\Logs\edb.chk
- <SYSTEM32>\CatRoot2\edb.chk
- <SYSTEM32>\wbem\Logs\wmiadap.log
- <SYSTEM32>\wbem\Logs\wmiprov.log
- <SYSTEM32>\wbem\Logs\mofcomp.log
- <SYSTEM32>\CatRoot2\edb00016.log
- <SYSTEM32>\CatRoot2\edb00017.log
- <SYSTEM32>\CatRoot2\edb00014.log
- <SYSTEM32>\CatRoot2\edb00015.log
- <SYSTEM32>\CatRoot2\res1.log
- <SYSTEM32>\MsDtc\Trace\dtctrace.log
- <SYSTEM32>\wbem\Logs\FrameWork.log
- <SYSTEM32>\CatRoot2\res2.log
- <SYSTEM32>\MsDtc\MSDTC.LOG
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
- %WINDIR%\KB942288-v3.log
- %WINDIR%\MedCtrOC.log
- %WINDIR%\iis6.log
- %WINDIR%\imsins.log
- %WINDIR%\msgsocm.log
- %WINDIR%\ntdtcsetup.log
- %WINDIR%\ocgen.log
- %WINDIR%\msmqinst.log
- %WINDIR%\netfxocm.log
- %WINDIR%\FaxSetup.log
- %WINDIR%\SET8.tmp
- <SYSTEM32>\CONFIG.TMP
- %WINDIR%\SET3.tmp
- %WINDIR%\SET4.tmp
- %WINDIR%\0.log
- %WINDIR%\comsetup.log
- %WINDIR%\DtcInstall.log
- %WINDIR%\cmsetacl.log
- %WINDIR%\COM+.log
- %WINDIR%\wiaservc.log
- %WINDIR%\WindowsUpdate.log
- %WINDIR%\updspapi.log
- %WINDIR%\wiadebug.log
- %WINDIR%\wmsetup.log
- %WINDIR%\Debug\UserMode\userenv.log
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.log
- %WINDIR%\Debug\blastcln.log
- %WINDIR%\Debug\NetSetup.LOG
- %WINDIR%\tsoc.log
- %WINDIR%\sessmgr.setup.log
- %WINDIR%\setupact.log
- %WINDIR%\ocmsn.log
- %WINDIR%\regopt.log
- %WINDIR%\setupapi.log
- %WINDIR%\Sti_Trace.log
- %WINDIR%\tabletoc.log
- %WINDIR%\setuperr.log
- %WINDIR%\spupdsvc.log
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
