Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\SA.DAT
Malicious functions:
Executes the following:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1144 -dm 7 7 %TEMP%\WER1945.dir00\svchost.exe.mdmp 16325836412031988
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\NetMeeting\rsewzjqn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %TEMP%\WER1945.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
Network activity:
Connects to:
- '82.#.144.252':445
- '82.#.171.145':445
- '82.#.212.106':445
- '82.#.218.211':445
- '82.#.15.74':445
- '82.#.167.230':445
- '82.#.49.19':445
- '82.#.73.86':445
- '82.#.23.18':445
- '82.#.204.94':445
- '82.#.252.141':445
- '82.#.91.65':445
- '82.#.52.234':445
- '82.#.140.238':139
- '82.#.157.106':139
- '82.#.127.174':139
- '82.#.101.156':139
- '82.#.47.191':139
- '82.#.166.188':139
- '82.#.226.46':139
- '82.#.213.217':445
- '82.#.247.42':445
- '82.#.173.231':445
- '82.#.57.41':139
- '82.#.210.137':139
- '82.#.73.16':139
- '82.#.157.106':445
- '82.#.127.174':445
- '82.#.226.46':445
- '82.#.47.191':445
- '82.#.166.188':445
- '82.#.140.238':445
- '82.#.57.41':445
- '82.#.73.8':139
- '82.#.243.72':139
- '82.#.174.41':139
- '82.#.210.137':445
- '82.#.73.16':445
- '82.#.7.165':139
- '82.#.255.77':445
- '82.#.206.95':445
- '82.#.108.46':445
- '82.#.237.153':445
- '82.#.122.183':445
- '82.#.77.114':445
- '82.#.250.209':445
- '82.#.206.186':445
- '82.#.17.204':445
- '82.#.101.156':445
- '82.#.144.182':445
- '82.#.189.10':445
- '82.#.6.126':445
- '82.#.188.81':445
- '82.#.243.89':445
- '82.#.153.252':445
- '82.#.17.207':445
- '82.#.28.122':445
- '82.#.82.13':445
- '82.#.53.192':445
- '82.#.145.45':445
- '82.#.213.217':139
- '82.#.247.42':139
- '82.#.118.53':445
- '82.#.63.118':445
- '82.#.48.64':445
- '82.#.28.122':139
- '82.#.82.13':139
- '82.#.188.81':139
- '82.#.33.71':445
- '82.#.114.178':445
- '82.#.17.207':139
- '82.#.243.89':139
- '82.#.63.118':139
- '82.#.48.64':139
- '82.#.145.45':139
- '82.#.153.252':139
- '82.#.53.192':139
- '82.#.118.53':139
- '82.#.77.114':139
- '82.#.255.77':139
- '82.#.206.95':139
- '82.#.204.94':139
- '82.#.237.153':139
- '82.#.122.183':139
- '82.#.108.46':139
- '82.#.6.126':139
- '82.#.206.186':139
- '82.#.17.204':139
- '82.#.250.209':139
- '82.#.144.182':139
- '82.#.189.10':139
- '82.#.167.230':139
- '82.#.144.252':139
- '82.#.171.145':139
- '82.#.173.231':139
- '82.#.218.211':139
- '82.#.15.74':139
- '82.#.212.106':139
- '82.#.52.234':139
- '82.#.73.86':139
- '82.#.23.18':139
- '82.#.49.19':139
- '82.#.252.141':139
- '82.#.91.65':139
- '82.#.44.191':139
- '82.#.170.85':445
- '82.#.73.39':445
- '82.#.121.97':445
- '82.#.83.136':445
- '82.#.250.20':445
- '82.#.47.114':445
- '82.#.101.24':445
- '82.#.86.168':445
- '82.#.218.79':445
- '82.#.20.26':445
- '82.#.67.95':445
- '82.#.68.144':445
- '82.#.215.67':445
- '82.#.73.151':445
- '82.#.251.242':445
- '82.#.245.208':445
- '82.#.225.237':139
- '82.#.125.103':139
- '82.#.112.230':139
- '82.#.36.224':445
- '82.#.127.70':445
- '82.#.12.64':445
- '82.#.136.162':445
- '82.#.180.53':445
- '82.#.207.190':445
- '82.#.33.21':445
- '82.#.28.34':139
- '82.#.161.45':139
- '82.#.39.157':139
- '82.#.125.103':445
- '82.#.112.230':445
- '82.#.34.147':139
- '82.#.94.22':139
- '82.#.76.161':139
- '82.#.63.181':139
- '82.#.64.21':139
- '82.#.56.4':139
- '82.#.81.177':139
- '82.#.39.32':139
- '82.#.8.112':445
- '82.#.18.246':445
- '82.#.200.2':445
- '82.#.115.235':445
- '82.#.132.96':445
- '82.#.5.145':445
- '82.#.93.248':445
- '82.#.87.56':445
- '82.#.121.63':445
- '82.#.225.237':445
- '82.#.254.63':445
- '82.#.12.17':445
- '82.#.100.208':445
- '82.#.40.181':445
- '82.#.73.151':139
- '82.#.251.242':139
- '82.#.33.134':445
- '82.#.56.15':445
- '82.#.131.243':445
- '82.#.245.208':139
- '82.#.33.21':139
- '82.#.127.70':139
- '82.#.12.64':139
- '82.#.36.224':139
- '82.#.180.53':139
- '82.#.207.190':139
- '82.#.56.15':139
- '82.#.131.243':139
- '82.#.40.181':139
- '82.#.13.38':139
- '82.#.133.165':139
- '82.#.33.134':139
- '82.#.7.165':445
- '82.#.44.191':445
- '82.#.13.38':445
- '82.#.133.165':445
- '82.#.73.8':445
- '82.#.243.72':445
- '82.#.174.41':445
- '82.#.5.145':139
- '82.#.8.112':139
- '82.#.18.246':139
- '82.#.20.26':139
- '82.#.115.235':139
- '82.#.132.96':139
- '82.#.200.2':139
- '82.#.100.208':139
- '82.#.87.56':139
- '82.#.121.63':139
- '82.#.93.248':139
- '82.#.254.63':139
- '82.#.12.17':139
- '82.#.47.114':139
- '82.#.170.85':139
- '82.#.73.39':139
- '82.#.136.162':139
- '82.#.83.136':139
- '82.#.250.20':139
- '82.#.121.97':139
- '82.#.215.67':139
- '82.#.86.168':139
- '82.#.218.79':139
- '82.#.101.24':139
- '82.#.67.95':139
- '82.#.68.144':139
- '82.#.215.39':445
- '82.#.7.235':445
- '82.#.194.7':445
- '82.#.216.104':445
- '82.#.182.219':445
- '82.#.108.122':445
- '82.#.98.69':445
- '82.#.33.78':445
- '82.#.252.203':445
- '82.#.140.75':445
- '82.#.75.252':445
- '82.#.31.34':445
- '82.#.4.166':445
- '82.#.0.126':445
- '82.#.53.38':445
- '82.#.145.163':445
- '82.#.248.101':445
- '82.#.164.33':445
- '82.#.216.164':445
- '82.#.101.200':445
- '82.#.166.247':445
- '82.#.11.32':445
- '82.#.21.119':445
- '82.#.120.15':445
- '82.#.47.35':445
- '82.#.63.249':445
- '82.#.159.116':445
- '82.#.77.36':445
- '82.#.187.246':445
- '82.#.181.149':445
- '82.#.124.124':445
- '82.#.22.138':445
- '82.#.26.224':445
- '82.#.82.191':445
- '82.#.182.245':445
- '82.#.53.38':9988
- '82.#.47.35':9988
- '82.#.87.131':445
- '82.#.29.241':445
- '82.#.91.71':445
- '82.#.99.132':445
- '82.#.29.42':445
- '82.#.40.29':445
- '82.#.138.139':445
- '82.#.29.139':445
- '82.#.157.123':445
- '82.#.23.40':445
- '82.#.249.78':445
- '82.#.181.250':445
- '82.#.77.141':445
- '82.#.58.243':445
- '82.#.62.203':445
- '82.#.217.177':445
- '82.#.98.69':139
- '82.#.7.235':139
- '82.#.194.7':139
- '82.#.120.15':139
- '82.#.182.219':139
- '82.#.108.122':139
- '82.#.216.104':139
- '82.#.0.126':139
- '82.#.252.203':139
- '82.#.75.252':139
- '82.#.33.78':139
- '82.#.31.34':139
- '82.#.4.166':139
- '82.#.145.163':139
- '82.#.53.38':139
- '82.#.101.200':139
- '82.#.164.33':139
- '82.#.34.185':139
- '82.#.216.164':139
- '82.#.248.101':139
- '82.#.159.116':139
- '82.#.11.32':139
- '82.#.21.119':139
- '82.#.166.247':139
- '82.#.47.35':139
- '82.#.63.249':139
- '82.#.26.224':139
- '82.#.77.36':139
- '82.#.187.246':139
- '82.#.77.141':139
- '82.#.124.124':139
- '82.#.22.138':139
- '82.#.181.149':139
- '82.#.91.71':139
- '82.#.182.245':139
- '82.#.34.185':445
- '82.#.82.191':139
- '82.#.87.131':139
- '82.#.29.241':139
- '82.#.157.123':139
- '82.#.99.132':139
- '82.#.29.42':139
- '82.#.140.75':139
- '82.#.138.139':139
- '82.#.29.139':139
- '82.#.40.29':139
- '82.#.217.177':139
- '82.#.181.250':139
- '82.#.249.78':139
- '82.#.23.40':139
- '82.#.58.243':139
- '82.#.62.203':139
- '82.#.63.249':9988
- '82.#.114.178':139
- '82.#.175.239':445
- '82.#.239.41':445
- '82.#.17.77':139
- '82.#.215.39':139
- '82.#.33.71':139
- '82.#.109.238':445
- '82.#.226.207':445
- '82.#.84.65':445
- '82.#.115.222':445
- '82.#.213.32':445
- '82.#.80.164':445
- '82.#.207.163':445
- '82.#.16.242':139
- '82.#.57.32':139
- '82.#.121.161':139
- '82.#.39.126':139
- '82.#.83.86':139
- '82.#.242.143':139
- '82.#.34.61':139
- '82.#.203.97':139
- '82.#.202.202':139
- '82.#.76.203':139
- '82.#.1.179':139
- '82.#.18.129':139
- '82.#.97.230':139
- '82.#.57.32':445
- '82.#.121.161':445
- '82.#.34.61':445
- '82.#.83.86':445
- '82.#.242.143':445
- '82.#.16.242':445
- '82.#.1.179':445
- '82.#.202.202':445
- '82.#.76.203':445
- '82.#.17.77':445
- '82.#.18.129':445
- '82.#.97.230':445
- '82.#.203.97':445
- '82.#.117.26':445
- '82.#.133.190':445
- '82.#.57.127':445
- '82.#.145.115':445
- '82.#.175.91':445
- '82.#.176.169':445
- '82.#.114.38':445
- '82.#.218.251':445
- '82.#.61.25':445
- '82.#.39.126':445
- '82.#.105.9':445
- '82.#.207.164':445
- '82.#.2.134':445
- '82.#.113.195':139
- '82.#.49.127':139
- '82.#.99.88':139
- '82.#.102.15':139
- '82.#.141.159':139
- '82.#.212.141':139
- '82.#.15.16':139
- '82.#.10.25':445
- '82.#.102.15':445
- '82.#.141.159':445
- '82.#.164.183':445
- '82.#.58.140':445
- '82.#.15.86':445
- '82.#.98.69':9988
- '82.#.7.235':9988
- '82.#.31.34':9988
- '82.#.159.116':9988
- '82.#.11.32':9988
- '82.#.182.219':9988
- '82.#.29.139':9988
- '82.#.58.140':139
- '82.#.15.86':139
- '82.#.10.25':139
- '82.#.157.123':9988
- '82.#.99.132':9988
- '82.#.164.183':139
- '82.#.176.169':139
- '82.#.117.26':139
- '82.#.133.190':139
- '82.#.115.222':139
- '82.#.145.115':139
- '82.#.175.91':139
- '82.#.57.127':139
- '82.#.2.134':139
- '82.#.218.251':139
- '82.#.61.25':139
- '82.#.114.38':139
- '82.#.105.9':139
- '82.#.207.164':139
- '82.#.99.88':445
- '82.#.15.16':445
- '82.#.175.239':139
- '82.#.212.141':445
- '82.#.113.195':445
- '82.#.49.127':445
- '82.#.239.41':139
- '82.#.207.163':139
- '82.#.226.207':139
- '82.#.84.65':139
- '82.#.109.238':139
- '82.#.213.32':139
- '82.#.80.164':139
