Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '38t2' = '%APPDATA%\dfhbt3y.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\MouseDriver] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- %APPDATA%\dfhbt3y.exe -d64771DF74483CB1472833C1B5014AAAF1085F383BBD9FB32A3CFE19737E1FB9387FBC8D50B77257B5D29933C0836527AA261977FBF14257986BF1965F18EA6D4FBB210BF474F2DC10C4D2D6A43B882887047195577C642425FEDFD95F5018503A4F3485A0618BD0DF432ACFB1FDCE1B47EC36A59104BCCFBC3E1D09E7F01DF1DA8BE00A995D7EE3AC9F8F2A1F7335ADE11FCBDBDF8F97A35871C124D0CD240A86B0E097480E6193582D5207A69F714BFAEC58033DBF947FEC1CC830C5B636E8D93EC746696DBD62D5222950F52C37A3E1AA46722A6EB6BE7C62525B566A075A205B9929EE250FF4EB0B1F465D01A33705B6E614886F55FEB299939B16C979BF0E50BF45EB23AAC184FA81E223E7729EFB4149FA6E9C6DC47C2F54008EA476B5199D56B9C92D93805251B324D3A248569AC7A93297AF8DCE9A390FB8C9CE5AED3C68608B1518D3A9167BD93B0A26CB06C0724EEBF299497B123C66ACB80986CDD50C31D50FAF38C478A71E26591205325CA24A0C620AA86ECD68AD0A1D262EE335D4939EEDBB146BE432CFE77666557E83A26DBF4CEF06219925BAC2710FBBEAB52C12F9B8116C289870F0A86BC69E53DDC7F108ADFFC24C16B56C06DF7ACA5A3D37B0E31B83599838B1466D971CC665B7599EF93403A
Executes the following:
- <SYSTEM32>\rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 %APPDATA%\mdinstall.inf
- <SYSTEM32>\net1.exe stop "Windows Firewall/Internet Connection Sharing (ICS)"
- <SYSTEM32>\runonce.exe -r
- <SYSTEM32>\grpconv.exe -o
- <SYSTEM32>\cmd.exe /c "%APPDATA%\um1unx4ss.bat"
- <SYSTEM32>\sc.exe config wscsvc start= DISABLED
- <SYSTEM32>\net.exe stop "Security Center"
- <SYSTEM32>\net.exe stop "Windows Firewall/Internet Connection Sharing (ICS)"
- <SYSTEM32>\net1.exe stop "Security Center"
- <SYSTEM32>\sc.exe config SharedAccess start= DISABLED
Modifies file system :
Creates the following files:
- %APPDATA%\mdinstall.inf
- %APPDATA%\um1unx4ss.bat
- %APPDATA%\dfhbt3y.exe
- %APPDATA%\MouseDriver.bat
Sets the 'hidden' attribute to the following files:
- %APPDATA%\MouseDriver.bat
Deletes the following files:
- %APPDATA%\mdinstall.inf
Deletes itself.
Network activity:
Connects to:
- 'w.#####ardiscover.com':888
UDP:
- DNS ASK w.#####ardiscover.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
