Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command] '' = '"<LS_APPDATA>\lwh.exe" -a "%PROGRAM_FILES%\Internet Explorer\iexplore.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Creates and executes the following:
- <LS_APPDATA>\lwh.exe -gav <Full path to virus>
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- opera.exe
- iexplore.exe
- firefox.exe
Modifies file system :
Creates the following files:
- %TEMP%\6h86d7sr2domqf81n08t4n
- %HOMEPATH%\Templates\6h86d7sr2domqf81n08t4n
- %ALLUSERSPROFILE%\Application Data\6h86d7sr2domqf81n08t4n
- <LS_APPDATA>\lwh.exe
- <LS_APPDATA>\6h86d7sr2domqf81n08t4n
Network activity:
Connects to:
- 'cu###otog.com':80
- 'qu###ebyve.com':80
- 'ro###avice.com':80
- 'py###omyc.com':80
- 'se####cusotemi.com':80
- 'ga###ugutil.com':80
- 'fo####bybydy.com':80
- 'ju####qakexyq.com':80
- 'bi###amot.com':80
- 'va####negiqi.com':80
- 'po###oxehyt.com':80
- 'nu###icovy.com':80
- 'jy####befukor.com':80
- 'sa####hopyqej.com':80
- 'ci####sepuxy.com':80
- 'ca###ulugy.com':80
- 'ke###epin.com':80
- 'tu###ejawat.com':80
- 'go###oliroc.com':80
- 'ki####narelo.com':80
- 'zo###uwex.com':80
UDP:
- DNS ASK fo####bybydy.com
- DNS ASK fa####fihovawe.com
- DNS ASK ji###oraw.com
- DNS ASK ga###ugutil.com
- DNS ASK bi###amot.com
- DNS ASK va####negiqi.com
- DNS ASK ju####qakexyq.com
- DNS ASK mu####tupukyqi.com
- DNS ASK fu###abyko.com
- DNS ASK microsoft.com
- DNS ASK za####tapuzog.com
- DNS ASK xe####kycimohu.com
- DNS ASK ru###ozod.com
- DNS ASK fy####madebet.com
- DNS ASK pe####jomimoz.com
- DNS ASK qu###ebyve.com
- DNS ASK zo###uwex.com
- DNS ASK jy####befukor.com
- DNS ASK ki####narelo.com
- DNS ASK nu###icovy.com
- DNS ASK ci####sepuxy.com
- DNS ASK sa####hopyqej.com
- DNS ASK ca###ulugy.com
- DNS ASK go###oliroc.com
- DNS ASK se####cusotemi.com
- DNS ASK ro###avice.com
- DNS ASK cu###otog.com
- DNS ASK py###omyc.com
- DNS ASK ke###epin.com
- DNS ASK tu###ejawat.com
- DNS ASK po###oxehyt.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'msascui_class' WindowName: ''
