Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'updatesyswin' = '<SYSTEM32>\updatesysw1n.com'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'updatesyswin' = '<SYSTEM32>\updatesysw1n.com'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'nabilah' = '%WINDIR%\n4b1l4h_jkt48.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'heavy_rotation' = '<SYSTEM32>\heavy_rotation.scr'
Creates the following files on removable media:
- <Drive name for removable media>:\Nabilah Ratna Ayu Azalia.exe
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\ayuchin.exe
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\updatesysw1n.com'
- '<SYSTEM32>\heavy_rotation.scr'
- '%WINDIR%\n4b1l4h_jkt48.exe'
Modifies settings of Windows Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFolderOptions' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
Modifies file system :
Creates the following files:
- <SYSTEM32>\heavy_rotation.scr
- <SYSTEM32>\updatesysw1n.com
- %WINDIR%\n4b1l4h_jkt48.exe
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\ayuchin.exe
- <Drive name for removable media>:\autorun.inf
- <SYSTEM32>\updatesysw1n.com
- %WINDIR%\n4b1l4h_jkt48.exe
- <SYSTEM32>\heavy_rotation.scr
Deletes the following files:
- %TEMP%\~DF1E67.tmp
- %TEMP%\~DF6527.tmp
- %TEMP%\~DF6C8E.tmp
- %TEMP%\~DF80B1.tmp
- %TEMP%\~DF6E2E.tmp
- %TEMP%\~DF3D8C.tmp
- %TEMP%\~DF2CC7.tmp
- %TEMP%\~DF45B0.tmp
- %TEMP%\~DF5A62.tmp
- %TEMP%\~DF57B1.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
