Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\ControlSet001\Services\wscsvc] 'Start' = '00000002'
- [HKLM\SYSTEM\ControlSet001\Services\wscsvc] 'ImagePath' = '<DRIVERS>\etc\kaiyizhihua.exe -pfajiezangshenamtf'
- [HKLM\SYSTEM\ControlSet002\Services\wscsvc] 'Start' = '00000002'
- [HKLM\SYSTEM\ControlSet002\Services\wscsvc] 'ImagePath' = '<DRIVERS>\etc\kaiyizhihua.exe -pfajiezangshenamtf'
- [HKLM\SYSTEM\CurrentControlSet\Services\wscsvc] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\wscsvc] 'ImagePath' = '<DRIVERS>\etc\kaiyizhihua.exe -pfajiezangshenamtf'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im ntvdm.exe
- '%WINDIR%\syswow64\net.exe' stop kaccore
- '%WINDIR%\syswow64\net.exe' stop SharedAccess
- '%WINDIR%\syswow64\taskkill.exe' /f /im CCenter.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im RavTask.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im RsMain.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im rsnetsvr.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im rsreport.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im RsStub.exe
- '%WINDIR%\syswow64\net.exe' stop KISSvc
- '%WINDIR%\syswow64\taskkill.exe' /f /im RsTray.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im waht.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im waituser.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im wscript.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im Privoxy.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im firefox.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im vvisit.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im ping.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im cmd.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im wupdmgr.exe
- '%WINDIR%\syswow64\net.exe' stop KPfwSvc
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\pwd.exe
- %TEMP%\ixp000.tmp\file.exe
- %WINDIR%\temp\loadpassword.bat
- %WINDIR%\temp\listen.exe
- %WINDIR%\temp\file.vbe
- <DRIVERS>\etc\1771290.htm
- <DRIVERS>\etc\loadboot.bat
- <DRIVERS>\etc\kaiyizhihua.exe
- <DRIVERS>\etc\boot.reg
- <DRIVERS>\etc\boot.vbe
- <DRIVERS>\etc\loadname.vbe
- <DRIVERS>\etc\loadwait.vbe
- nul
- %ProgramFiles%\internet explorer\wupdmgr.exe
Sets the 'hidden' attribute to the following files
- <DRIVERS>\etc\1771290.htm
- <DRIVERS>\etc\loadboot.bat
- <DRIVERS>\etc\kaiyizhihua.exe
- <DRIVERS>\etc\boot.reg
- <DRIVERS>\etc\boot.vbe
- <DRIVERS>\etc\loadname.vbe
- <DRIVERS>\etc\loadwait.vbe
Deletes the following files
- %TEMP%\ixp000.tmp\file.exe
- %TEMP%\ixp000.tmp\pwd.exe
- %WINDIR%\temp\listen.exe
- %WINDIR%\temp\loadpassword.bat
- %WINDIR%\temp\file.vbe
Network activity
UDP
- DNS ASK ba##u.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\ixp000.tmp\pwd.exe'
- '%TEMP%\ixp000.tmp\file.exe'
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\temp\file.VBE"
- '%WINDIR%\temp\listen.exe' -pfajiezangshenamtf
- '%WINDIR%\syswow64\wscript.exe' "<DRIVERS>\etc\loadwait.vbe"
Executes the following
- '%WINDIR%\syswow64\attrib.exe' -r -s -h -a boot.reg
- '%WINDIR%\syswow64\sc.exe' config wscsvc start= auto
- '%WINDIR%\syswow64\cmd.exe' /c dir "C:\Documents and Settings\123456[1].txt" /s /a|findstr /i "Content.IE5"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 5
- '%WINDIR%\syswow64\mshta.exe' vbscript:createobject("wscript.shell").run("""%ProgramFiles(x86)%\Internet Explorer\wupdmgr.exe"" file:///C:/WINDOWS/system32/drivers/etc/1771290.htm",0)(window.close)
- '%WINDIR%\syswow64\ping.exe' www.baidu.com -n 5
- '%WINDIR%\syswow64\sc.exe' config KISSvc start= disabled
- '%WINDIR%\syswow64\sc.exe' config kaccore start= disabled
- '%WINDIR%\syswow64\sc.exe' config SharedAccess start= disabled
- '%WINDIR%\syswow64\findstr.exe' /i "Content.IE5"
- '%WINDIR%\syswow64\sc.exe' config KPfwSvc start= disabled
- '%WINDIR%\syswow64\net1.exe' stop KISSvc
- '%WINDIR%\syswow64\net1.exe' stop kaccore
- '%WINDIR%\syswow64\net1.exe' stop SharedAccess
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2
- '%WINDIR%\syswow64\attrib.exe' -r -s -h -a loadname.vbe
- '%WINDIR%\syswow64\regedit.exe' /s boot.reg
- '%WINDIR%\syswow64\cmd.exe' /c ""<DRIVERS>\etc\loadboot.bat" "
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" dir "C:\Documents and Settings\123456[1].txt" /s /a"
- '%WINDIR%\syswow64\net1.exe' stop KPfwSvc
- '%TEMP%\ixp000.tmp\file.exe' ' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im Privoxy.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im firefox.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""<DRIVERS>\etc\loadboot.bat" "' (with hidden window)
- '%WINDIR%\temp\listen.exe' -pfajiezangshenamtf' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im cmd.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im ntvdm.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im vvisit.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im ping.exe' (with hidden window)
- '%TEMP%\ixp000.tmp\pwd.exe' ' (with hidden window)
