Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ialdnwxf] 'ImagePath' = '<Current directory>\my.sys'
Malicious functions:
Executes the following:
- '<Current directory>\1000.exe'
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtQuerySystemInformation, handler: unknown
- NtReadFile, handler: unknown
- NtQueryDirectoryFile, handler: unknown
- NtOpenSection, handler: unknown
- NtOpenThread, handler: unknown
- NtTerminateProcess, handler: unknown
- NtWriteFile, handler: unknown
- NtSetValueKey, handler: unknown
- NtSetSecurityObject, handler: unknown
- NtSetSystemInformation, handler: unknown
- NtCreateSection, handler: unknown
- NtDeleteKey, handler: unknown
- NtCreateKey, handler: unknown
- NtClose, handler: unknown
- NtCreateFile, handler: unknown
- NtOpenKey, handler: unknown
- NtOpenProcess, handler: unknown
- NtOpenFile, handler: unknown
- NtDeleteValueKey, handler: unknown
- NtLoadDriver, handler: unknown
Hides the following processes:
- <Current directory>\1000.exe
Modifies file system:
Creates the following files:
- <Current directory>\my.sys
- <Current directory>\1000.exe
- <Current directory>\test.ini
Deletes the following files:
- <Current directory>\my.sys
Network activity:
Connects to:
- 'sw##.#####n-shenzhen.aliyuncs.com':80
TCP:
HTTP GET requests:
- http://sw##.#####n-shenzhen.aliyuncs.com/up.txt
UDP:
- DNS ASK sw##.#####n-shenzhen.aliyuncs.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
