Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmPlayer.exe] 'debugger' = 'rundll32'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmClient.exe] 'debugger' = 'rundll32'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClientCore.exe] 'debugger' = 'rundll32'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\PolicyAgent] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\ipsec_block\ipseccmd.exe' -w REG -p "IPSEC_BLOCK" -r "nxp Back door UDP/137" -f 0+*:137:UDP -n BLOCK
- 'C:\ipsec_block\ipseccmd.exe' -w REG -p "IPSEC_BLOCK" -r "nxp Back door UDP/135" -f 0+*:135:UDP -n BLOCK
- 'C:\ipsec_block\ipseccmd.exe' -w REG -p "IPSEC_BLOCK" -x
- 'C:\checkmd5\unsafe.EXE'
- 'C:\ipsec_block\ipseccmd.exe' -w REG -p "IPSEC_BLOCK" -o -x
- 'C:\ipsec_block\ipseccmd.exe' -w REG -p "IPSEC_BLOCK" -r "nxp Back door UDP/722" -f 0+*:722:UDP -n BLOCK
- 'C:\ipsec_block\ipseccmd.exe' -w REG -p "IPSEC_BLOCK" -r "nxp Back door UDP/23246" -f 0+*:23246:UDP -n BLOCK
- 'C:\ipsec_block\ipseccmd.exe' -w REG -p "IPSEC_BLOCK" -r "nxp Back door UDP/720" -f 0+*:720:UDP -n BLOCK
- 'C:\ipsec_block\ipseccmd.exe' -w REG -p "IPSEC_BLOCK" -r "nxp Back door UDP/138" -f 0+*:138:UDP -n BLOCK
- 'C:\ipsec_block\ipseccmd.exe' -w REG -p "IPSEC_BLOCK" -r "nxp Back door UDP/445" -f 0+*:445:UDP -n BLOCK
- '<SYSTEM32>\wx20120304\CheckMd5.exe'
- '<SYSTEM32>\HideShell.exe'
- '<SYSTEM32>\wx20120304\instbho.exe'
- '<SYSTEM32>\wx20120304\Loadexe.exe'
- '<SYSTEM32>\wx20120304\lockieinf.exe'
- '<SYSTEM32>\WxQQIee.wx'
- 'C:\ipsec_block\gpupdate.exe'
- 'C:\checkmd5\Ytbaoan.exe'
- 'C:\checkmd5\Xp.exe'
- '<SYSTEM32>\wx20120304\KillRzxPl.exe'
Executes the following:
- '<SYSTEM32>\sc.exe' start IPSEC Services
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\d3d8.dll /p everyone:f
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\wx20120304\killpro.cmd" "
- '<SYSTEM32>\sc.exe' failure PolicyAgent reset= 30 actions= restart/5000
- '<SYSTEM32>\sc.exe' config PolicyAgent start= AUTO
- '<SYSTEM32>\wscript.exe' "<SYSTEM32>\wx20120304\ok.VBS"
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\dsound.dll /p everyone:f
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\olepro32.dll /p everyone:f
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\rasadhlp.dll /p everyone:f
- '<SYSTEM32>\gpupdate.exe'
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\comres.dll /p everyone:f
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\d3d8thk.dll /p everyone:f
- '<SYSTEM32>\sc.exe' config mediaplayerservice start= disabled
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\hnetcfg.dll /p everyone:f
- '<SYSTEM32>\taskkill.exe' /f /im MTService.exe
- '<SYSTEM32>\wscript.exe' "c:\checkmd5\setconfig.vbs"
- '%WINDIR%\regedit.exe' /s .\jyexe.reg
- '<SYSTEM32>\wscript.exe' "c:\ipsec_block\setconfig.vbs"
- '<SYSTEM32>\svchost.exe'
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\wx20120304\myrun.cmd
- '<SYSTEM32>\wscript.exe' "<SYSTEM32>\yhrunme.vbs"
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\yhrunme.cmd" "
- '<SYSTEM32>\wscript.exe' "c:\KillProc\ok.vbs"
- '<SYSTEM32>\cmd.exe' /c ""c:\KillProc\disrzxpl.cmd" "
- '<SYSTEM32>\cmd.exe' /c ""c:\ipsec_block\run.bat" "
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\ddraw.dll /p everyone:f
- '<SYSTEM32>\cmd.exe' /c C:\checkmd5\OemDll\copyoem.cmd
- '<SYSTEM32>\cmd.exe' /c c:\checkmd5\disablesafe.cmd
- '<SYSTEM32>\taskkill.exe' /f /im userinit.exe
- '<SYSTEM32>\cacls.exe' c:\msvcr81.dll /D everyone
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\svchost.exe
Forces autoplay for removable media.
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- C:\ipsec_block\polstore.dll
- C:\ipsec_block\winipsec.dll
- C:\checkmd5\setconfig.vbs
- C:\checkmd5\Xp.exe
- C:\ipsec_block\gpupdate.exe
- C:\ipsec_block\setconfig.vbs
- C:\KillProc\ok.VBS
- C:\ipsec_block\ipseccmd.exe
- C:\ipsec_block\run.bat
- C:\checkmd5\OemDll\d3d8thk.dll
- C:\checkmd5\OemDll\ddraw.dll
- C:\checkmd5\OemDll\copyoem.cmd
- C:\checkmd5\OemDll\d3d8.dll
- C:\checkmd5\OemDll\dsound.dll
- C:\checkmd5\OemDll\rasadhlp.dll
- C:\checkmd5\OemDll\userinit.exe
- C:\checkmd5\OemDll\hnetcfg.dll
- C:\checkmd5\OemDll\olepro32.dll
- C:\KillProc\disrzxpl.cmd
- <SYSTEM32>\GroupPolicy\gpt.ini
- <SYSTEM32>\GroupPolicy\Machine\Registry.pol
- <SYSTEM32>\GroupPolicy\Adm\wmplayer.adm
- <SYSTEM32>\GroupPolicy\Adm\wuau.adm
- <SYSTEM32>\GroupPolicy\User\Registry.pol
- <SYSTEM32>\Msiework.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wbgetip[1].asp
- <SYSTEM32>\runbat.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wbgetip[1].asp
- C:\safe.log
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ytbaoan[1].dll
- C:\KillProc\mycacls.exe
- <SYSTEM32>\WxQQIee.wx
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wbgetip[1].asp
- <SYSTEM32>\GroupPolicy\Adm\inetres.adm
- <SYSTEM32>\GroupPolicy\Adm\system.adm
- <SYSTEM32>\GroupPolicy\Adm\admfiles.ini
- <SYSTEM32>\GroupPolicy\Adm\conf.adm
- <SYSTEM32>\wx20120304\KillRzxPl.exe
- <SYSTEM32>\lockie.inf
- <SYSTEM32>\wx20120304\ido_WXC.EXE
- <SYSTEM32>\wx20120304\CheckMd5.exe
- <SYSTEM32>\MainShell.dll
- <SYSTEM32>\antimon.dll
- <SYSTEM32>\HideShell.exe
- <SYSTEM32>\yhrunme.cmd
- <SYSTEM32>\yhrunme.VBS
- <SYSTEM32>\wx20120304\lockieinf.exe
- <SYSTEM32>\wx20120304\instbho.exe
- <SYSTEM32>\wx20120304\Loadexe.exe
- <SYSTEM32>\wx20120304\myrun.cmd
- <SYSTEM32>\wx20120304\ok.VBS
- <SYSTEM32>\wx20120304\hnadvRar.exe
- <SYSTEM32>\wx20120304\OpenHnadv.exe
- <SYSTEM32>\wx20120304\killpro.cmd
- <SYSTEM32>\wx20120304\JYexe.reg
- <SYSTEM32>\MSWINSCK.bak
- C:\checkmd5\unsafe.EXE
- C:\checkmd5\MSWINSCK.OCX
- C:\checkmd5\ytsafe01.EXE
- C:\checkmd5\disablesafe.cmd
- C:\checkmd5\kill.exe
- C:\checkmd5\OemDll\checkfile.ini
- C:\checkmd5\OemDll\comres.dll
- C:\checkmd5\Ytbaoan.dll
- C:\checkmd5\WatchNet.ini
- <SYSTEM32>\MRzxHost.dll
- <SYSTEM32>\Mscsyhie.dll
- <SYSTEM32>\wxrunme.dll
- <SYSTEM32>\lockie.dll
- <SYSTEM32>\mswinsck.ocx
- C:\checkmd5\checkfile.ini
- C:\checkmd5\enablesafe.cmd
- C:\checkmd5\traycon.ocx
- C:\checkmd5\Ytbaoan.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\GroupPolicy\Adm\admfiles.ini
Deletes the following files:
- <SYSTEM32>\wx20120304\OpenHnadv.exe
- <SYSTEM32>\wxrunme.dll
- <SYSTEM32>\wx20120304\Loadexe.exe
- <SYSTEM32>\wx20120304\lockieinf.exe
- C:\KillProc\disrzxpl.cmd
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wbgetip[1].asp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wbgetip[1].asp
- C:\KillProc\mycacls.exe
- C:\KillProc\ok.VBS
- <SYSTEM32>\wx20120304\KillRzxPl.exe
- <SYSTEM32>\yhrunme.cmd
- <SYSTEM32>\yhrunme.VBS
- <SYSTEM32>\HideShell.exe
- <SYSTEM32>\MainShell.dll
- <SYSTEM32>\antimon.dll
- <SYSTEM32>\wx20120304\ido_WXC.EXE
- <SYSTEM32>\wx20120304\instbho.exe
- <SYSTEM32>\wx20120304\CheckMd5.exe
- <SYSTEM32>\wx20120304\hnadvRar.exe
Network activity:
Connects to:
- 'dh.##wblm.com':80
- 'localhost':1042
- 'localhost':1036
- 'localhost':1037
TCP:
HTTP GET requests:
- dh.##wblm.com/getip/wbgetip.asp
- dh.##wblm.com/ytbaoan/ytbaoan.dll
UDP:
- DNS ASK www.i8##.com
- DNS ASK ch####ha.cswblm.com
- DNS ASK dh.##wblm.com
- 'localhost':13331
- 'localhost':13332
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'www.tao123.com'
- ClassName: 'Progman' WindowName: '(null)'
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'SHELLDLL_DefView' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'www.baidu.com'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
