Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{A6479374-1B82-F983-DBED-B41DE19E8E0A}] 'StubPath' = 'winver16.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'IgfxTray' = 'winver16.exe'
Malicious functions:
Creates and executes the following:
- %TEMP%\tmp2.exe
Executes the following:
- <SYSTEM32>\reg.exe add HKLM\SYSTEM\CurrentControlSet\Services\IpFilterDriver /v imagepath /t REG_EXPAND_SZ /d System32\DRIVERS\ipfltdrv.sys /f
- <SYSTEM32>\reg.exe add HKLM\SYSTEM\CurrentControlSet\Services\IpFilterDriver /v imagepath /t REG_EXPAND_SZ /d system32\52305.tmp /f
Modifies file system :
Creates the following files:
- <SYSTEM32>\dllcache\aic77ux.sys
- %WINDIR%\Installer\b287ee.msi
- <SYSTEM32>\winver16.exe
- %HOMEPATH%\Cookies\index64.dat
- %TEMP%\<Virus name>.doc
- %TEMP%\tmp2.exe
- %HOMEPATH%\52305.tmp
Deletes the following files:
- %HOMEPATH%\Cookies\index64.dat
- <SYSTEM32>\52305.tmp
Network activity:
Connects to:
- '64.#4.23.82':80
TCP:
HTTP GET requests:
- 64.#4.23.82/search?io#################################################################################################################################################
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'WordPadClass' WindowName: ''
