Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Changes the following executable system files
- %WINDIR%\flash_sa.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\edmgen.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\dfsvc.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\datasvcutil.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\comsvcconfig.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\caspol.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_wp.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_state.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regsql.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regiis.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regbrowsers.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\applaunch.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\ilasm.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\addinutil.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\addinprocess.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\wsatconfig.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\smsvchost.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\servicemodelreg.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\regtlibv12.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\ngen.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.workflow.compiler.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\jsc.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\addinprocess32.exe
- <SYSTEM32>\javaws.exe
- %WINDIR%\winsxs\amd64_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.1.7600.16385_none_fe560f0352e04f48\minesweeper.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\microsoft.workflow.compiler.exe
- %WINDIR%\winsxs\amd64_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.1.7600.16385_none_d1124c00155dfd14\solitaire.exe
- %WINDIR%\winsxs\amd64_microsoft-windows-s..mes-spidersolitaire_31bf3856ad364e35_6.1.7600.16385_none_dead260d8f002b73\spidersolitaire.exe
- %WINDIR%\winsxs\amd64_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.1.7600.16385_none_4ffeefd67d89d45b\hearts.exe
- %WINDIR%\winsxs\amd64_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_b466b741b68bd29a\freecell.exe
- %WINDIR%\temp\8147932992814195939363050711163993686\adobearm.exe
- %WINDIR%\syswow64\urttemp\regtlib.exe
- %WINDIR%\syswow64\macromed\flash\flashutil32_19_0_0_207_activex.exe
- %WINDIR%\syswow64\macromed\flash\flashutil32_18_0_0_261_plugin.exe
- %WINDIR%\syswow64\macromed\flash\flashplayerupdateservice.exe
- %WINDIR%\syswow64\macromed\flash\flashplayerplugin_18_0_0_261.exe
- %WINDIR%\syswow64\flashplayerapp.exe
- <SYSTEM32>\macromed\flash\flashutil64_19_0_0_207_activex.exe
- <SYSTEM32>\macromed\flash\flashutil64_18_0_0_261_plugin.exe
- <SYSTEM32>\vmicsvc.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\ilasm.exe
- <SYSTEM32>\mpsigstub.exe
- <SYSTEM32>\javaw.exe
- <SYSTEM32>\java.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setuputility.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setup.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\wsatconfig.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\smsvchost.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\servicemodelreg.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\regtlibv12.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\regsvcs.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\mscorsvw.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\jsc.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\edmgen.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\al.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\wsatconfig\fb3f50d8fd5c7254eca025df89c1c64c\wsatconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\smsvchost\606912f2d4b279cec3ec26662a8f34df\smsvchost.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\msbuild\a8f635efce2e3fc7be74208b99ed3a2c\msbuild.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w71daf281#\175b5ddd4326a1c6276b57fccd665f33\microsoft.workflow.compiler.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\dfsvc\c2b611647540100d5b90aa0c78a55b24\dfsvc.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\comsvcconfig\78057af6d175256f57ab7485d2a09f3d\comsvcconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\wsatconfig\d3ecda9cb1a8d633e0d04fb5dd8b2642\wsatconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\smsvchost\87c7416378ee1c4260e4c526945da716\smsvchost.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\msbuild\63d5741d60e99116874a074a55de0d72\msbuild.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w71daf281#\29c5329e2c2d33550395749eca61d0da\microsoft.workflow.compiler.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\dfsvc\ad40b26cf5e057de04fce0e6327b4589\dfsvc.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\comsvcconfig\e8405cd5c2aa6202ebb8f5652987bd33\comsvcconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\wsatconfig\36ca2928b2191011831ab673861c6ac6\wsatconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\smsvchost\04d794428d635f6a82ac57dd3d6f3628\smsvchost.ni.exe
- %WINDIR%\microsoft.net\netfxrepair.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\presentationfontcac#\0246845f487e5f33d3564eff578665a3\presentationfontcache.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\msbuild\1a154709cdfe214029ea88c51ab2b579\msbuild.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\mcupdate.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\loadmxf\d09b54cd68bc772b3be3832926e940d4\loadmxf.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\ehexthost\ad37b6e3a1cb1081592f1c5797ae9dad\ehexthost.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\dfsvc.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\comsvcconfig\d632b7434f821829827657e23ac98589\comsvcconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\wsatconfig\96a8bdafba9f9d3e33cd974bfaa67e58\wsatconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\smsvchost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\smsvchost.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\presentationfontcac#\b3ade8d5c0d4bb5d4940bcafd3453642\presentationfontcache.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\narrator\0bae62c3fc6c327ed24989263988173d\narrator.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\msbuild\af28543d9b3e7d9f110448ecce53cd72\msbuild.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\ehexthost32\c899de3549784161aa66610d5735e4f0\ehexthost32.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\comsvcconfig\5f1a06c0108b2c81cde1dc491d74043d\comsvcconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\narrator\4cc02fad33053737088d4c18267ca0a0\narrator.ni.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\regsvcs.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\datasvcutil.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\aspnet_regiis.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\comsvcconfig.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_wp.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_regsql.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_regiis.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_regbrowsers.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinutil.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\dfsvc.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\vbc.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\regasm.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\ngen.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\migpolwin.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\migpol.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\jsc.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\installutil.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\ilasm.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\ieexec.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\cvtres.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\csc.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\configwizards.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\caspol.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\aspnet_wp.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\aspnet_state.exe
- %WINDIR%\microsoft.net\assembly\gac_msil\microsoft.workflow.compiler\v4.0_4.0.0.0__31bf3856ad364e35\microsoft.workflow.compiler.exe
- %WINDIR%\winsxs\amd64_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.1.7600.16385_none_622070221822eb39\purbleplace.exe
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop "Security Center"
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=disable
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\8620.tmp\8630.tmp\8631.bat
- <Current directory>\inflist_exe.txt
- %ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\<File name>.exe
- %ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\<File name>.exe
- %ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\<File name>.exe
- %WINDIR%\panther\setup.exe\<File name>.exe
- <Current directory>\pathhost
Network activity
UDP
- 'localhost':59850
- 'localhost':49925
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\8620.tmp\8630.tmp\8631.bat <Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\8620.tmp\8630.tmp\8631.bat <Full path to file>"
- '<SYSTEM32>\tskill.exe' /A cc*
- '<SYSTEM32>\tskill.exe' /A norton*
- '<SYSTEM32>\tskill.exe' /A norton au*
- '<SYSTEM32>\tskill.exe' /A ccc*
- '<SYSTEM32>\tskill.exe' /A npfmn*
- '<SYSTEM32>\tskill.exe' /A loge*
- '<SYSTEM32>\tskill.exe' /A nisum*
- '<SYSTEM32>\tskill.exe' /A issvc
- '<SYSTEM32>\tskill.exe' /A tmp*
- '<SYSTEM32>\tskill.exe' /A tmn*
- '<SYSTEM32>\tskill.exe' /A pcc*
- '<SYSTEM32>\tskill.exe' /A cpd*
- '<SYSTEM32>\tskill.exe' /A pop*
- '<SYSTEM32>\tskill.exe' /A cle
- '<SYSTEM32>\tskill.exe' /A pav*
- '<SYSTEM32>\tskill.exe' /A panda*
- '<SYSTEM32>\tskill.exe' /A avsch*
- '<SYSTEM32>\tskill.exe' /A sche*
- '<SYSTEM32>\tskill.exe' /A syman*
- '<SYSTEM32>\tskill.exe' /A virus*
- '<SYSTEM32>\tskill.exe' /A realm*
- '<SYSTEM32>\tskill.exe' /A sweep*
- '<SYSTEM32>\tskill.exe' /A scan*
- '<SYSTEM32>\tskill.exe' /A ad-*
- '<SYSTEM32>\tskill.exe' /A safe*
- '<SYSTEM32>\tskill.exe' /A avas*
- '<SYSTEM32>\tskill.exe' /A norm*
- '<SYSTEM32>\tskill.exe' /A offg*
- '<SYSTEM32>\tskill.exe' /A zlclien*
- '<SYSTEM32>\tskill.exe' /A minilog
- '<SYSTEM32>\tskill.exe' /A upd*
- '<SYSTEM32>\tskill.exe' /A zauinst
- '<SYSTEM32>\tskill.exe' /A zap*
- '<SYSTEM32>\tskill.exe' /A av*
- '<SYSTEM32>\tskill.exe' /A fire*
- '<SYSTEM32>\tskill.exe' /A anti*
- '<SYSTEM32>\tskill.exe' /A spy*
- '<SYSTEM32>\tskill.exe' /A bullguard
- '<SYSTEM32>\tskill.exe' /A PersFw
- '<SYSTEM32>\tskill.exe' /A KAV*
- '<SYSTEM32>\tskill.exe' /A ZONEALARM
- '<SYSTEM32>\tskill.exe' /A SAFEWEB
- '<SYSTEM32>\tskill.exe' /A OUTPOST
- '<SYSTEM32>\tskill.exe' /A nv*
- '<SYSTEM32>\tskill.exe' /A nav*
- '<SYSTEM32>\tskill.exe' /A F-*
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Y "
- '<SYSTEM32>\tskill.exe' /A padmin
- '<SYSTEM32>\tskill.exe' /A ESAFE
- '<SYSTEM32>\tskill.exe' /A def*
- '<SYSTEM32>\tskill.exe' /A kav
- '<SYSTEM32>\tskill.exe' /A avg*
- '<SYSTEM32>\tskill.exe' /A ash*
- '<SYSTEM32>\tskill.exe' /A aswupdsv
- '<SYSTEM32>\tskill.exe' /A ewid*
- '<SYSTEM32>\tskill.exe' /A guard*
- '<SYSTEM32>\tskill.exe' /A guar*
- '<SYSTEM32>\tskill.exe' /A msmp*
- '<SYSTEM32>\tskill.exe' /A mcafe*
- '<SYSTEM32>\tskill.exe' /A mghtml
- '<SYSTEM32>\tskill.exe' /A msiexec
- '<SYSTEM32>\tskill.exe' /A isafe
- '<SYSTEM32>\net1.exe' stop "Security Center"
- '<SYSTEM32>\tskill.exe' /A BLACKICE
- '<SYSTEM32>\cmd.exe' /S /D /c" FOR /F "tokens=1,* delims=: " %j in (InfList_exe.txt) do copy <Full path to file> "%j:%k""
