Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Jirachi' = 'Jirachi.exe'
Malicious functions:
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /F /T /R
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\sunbannA.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tech.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Technical.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Sweets Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Sweets.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Maize.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Leaves.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Network Blitz Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Network Blitz.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Nature.exe
- %CommonProgramFiles%\Microsoft Shared\Web Folders\MSONSEXT.exe
- %CommonProgramFiles%\Microsoft Shared\Web Folders\MSOWS409.exe
- %CommonProgramFiles%\Microsoft Shared\VC\msdia90.exe
- %CommonProgramFiles%\Microsoft Shared\VGX\vgx.exe
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\fp4autl.exe
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\FP4AWEC.exe
- %CommonProgramFiles%\Microsoft Shared\Web Folders\PUBPLACE.exe
- %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\FPEXT.exe
- %CommonProgramFiles%\Microsoft Shared\VC\msdia80.exe
- %CommonProgramFiles%\Microsoft Shared\TextConv\mswrd632.exe
- %CommonProgramFiles%\Microsoft Shared\TextConv\mswrd832.exe
- %CommonProgramFiles%\Microsoft Shared\TextConv\html32.exe
- %CommonProgramFiles%\Microsoft Shared\TextConv\msconv97.exe
- %CommonProgramFiles%\Microsoft Shared\Triedit\TRIEDIT.exe
- %CommonProgramFiles%\Microsoft Shared\VC\msdia100.exe
- %CommonProgramFiles%\Microsoft Shared\TextConv\write32.exe
- %CommonProgramFiles%\Microsoft Shared\Triedit\DHTMLED.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Ivy.exe
- %CommonProgramFiles%\Microsoft Shared\DW\3082\DWINTL20.exe
- %CommonProgramFiles%\Microsoft Shared\DW\DWDCW20.exe
- %CommonProgramFiles%\Microsoft Shared\DW\1042\DWINTL20.exe
- %CommonProgramFiles%\Microsoft Shared\DW\2052\DWINTL20.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\1033\spcplui.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\sapi.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\IEFILES5.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\IEINFO5.exe
- %CommonProgramFiles%\Microsoft Shared\DW\1041\DWINTL20.exe
- %CommonProgramFiles%\Microsoft Shared\DW\1025\DWINTL20.exe
- %CommonProgramFiles%\Microsoft Shared\DW\1028\DWINTL20.exe
- <SYSTEM32>\Jirachi.exe
- %CommonProgramFiles%\Microsoft Shared\DAO\dao360.exe
- %CommonProgramFiles%\Microsoft Shared\DW\1036\DWINTL20.exe
- %CommonProgramFiles%\Microsoft Shared\DW\1040\DWINTL20.exe
- %CommonProgramFiles%\Microsoft Shared\DW\1031\DWINTL20.exe
- %CommonProgramFiles%\Microsoft Shared\DW\1033\DWINTL20.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\fieruled.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Citrus Punch.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Glacier.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Citrus Punch Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\anabnr2.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\aswrule.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\aleabanr.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\amaizrul.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Btzhsepa.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\citbannA.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Blank Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Blank.exe
Deletes the following files:
- <SYSTEM32>\dllcache\NT5INF.CAT
- %CommonProgramFiles%\Microsoft Shared\Stationery\Blank Bkgrd.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\amaizrul.exe
