Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'IcePoint' = '%WINDIR%\IcePoint.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\IcePoint] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\IcePoint.exe'
Executes the following:
- '<SYSTEM32>\net1.exe' stop sharedaccess
- '<SYSTEM32>\net.exe' stop "Automatic Updates"
- '<SYSTEM32>\net.exe' stop "TCP/IP NetBIOS Helper"
- '<SYSTEM32>\sc.exe' config "TCP/IP NetBIOS Helper" start= DISABLED
- '<SYSTEM32>\sc.exe' config "Automatic Updates" start= DISABLED
- '<SYSTEM32>\net1.exe' stop "Automatic Updates"
- '<SYSTEM32>\grpconv.exe' -o
- '<SYSTEM32>\net1.exe' stop "System Restore Service"
- '<SYSTEM32>\net1.exe' stop "TCP/IP NetBIOS Helper"
- '<SYSTEM32>\net1.exe' stop "Windows Firewall/Internet Connection Sharing (ICS)"
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\net.exe' stop "Windows Firewall/Internet Connection Sharing (ICS)"
- '<SYSTEM32>\cmd.exe' /c ""C:\kill.bat""
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 128 %WINDIR%\driver.inf
- '<SYSTEM32>\sc.exe' config "Windows Firewall/Internet Connection Sharing (ICS)" start= DISABLED
- '<SYSTEM32>\net.exe' stop "System Restore Service"
- '<SYSTEM32>\sc.exe' config "System Restore Service" start= DISABLED
- '<SYSTEM32>\net.exe' stop sharedaccess
- '<SYSTEM32>\sc.exe' config sharedaccess start= DISABLED
Modifies file system :
Creates the following files:
- %WINDIR%\driver.inf
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\kill.bat
- %WINDIR%\IcePoint.exe
Deletes the following files:
- %TEMP%\~DFE65.tmp
Deletes itself.
Network activity:
Connects to:
- 'any':2222
