Win32.HLLP.Rox.1.origin

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '<SYSTEM32>\dnsq.dll'

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\NetApi000] 'ImagePath' = 'C:\NetApi000.sys'

Creates the following files on removable media

Malicious functions

Creates and loads libraries (exploit)

Executes the following

Modifies file system

Creates the following files

Sets the 'hidden' attribute to the following files

Deletes the following files

Substitutes the following files

Network activity

TCP

HTTP GET requests

http://w.##mo.com/r.htm
http://pa###ngcrew.net/assets/scripts/js3.js
http://w.##mo.com/track.php?do###############################################################################################################################################################
http://iy###arch.com/?dn#######################

UDP

Miscellaneous

Searches for the following windows

Creates and executes the following

'<SYSTEM32>\com\smss.exe' %ALLUSERSPROFILE%\Start Menu\Programs\Startup\~.exe
'<SYSTEM32>\com\lsass.exe'
'<SYSTEM32>\cmd.exe' /c echo ok' (with hidden window)
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\com\bak"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\dnsq.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\com\netcfg.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\com\netcfg.000"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\com\lsass.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\com\smss.exe"' (with hidden window)
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com\smss.exe /e /t /g Everyone:F' (with hidden window)
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com\smss.exe /e /t /g user:F' (with hidden window)
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com\lsass.exe /e /t /g Everyone:F' (with hidden window)
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com\lsass.exe /e /t /g user:F' (with hidden window)
'<SYSTEM32>\regsvr32.exe' <SYSTEM32>\com\netcfg.dll /s' (with hidden window)
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com /e /t /g Everyone:F' (with hidden window)
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com /e /t /g user:F' (with hidden window)
'<SYSTEM32>\ping.exe' -f -n 1 www.ba##u.com' (with hidden window)
'%ProgramFiles%\internet explorer\iexplore.exe' http://w.##mo.com/r.htm' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c echo ok
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com /e /t /g user:F
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com /e /t /g Everyone:F
'<SYSTEM32>\regsvr32.exe' <SYSTEM32>\com\netcfg.dll /s
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com\lsass.exe /e /t /g user:F
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com\lsass.exe /e /t /g Everyone:F
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com\smss.exe /e /t /g user:F
'<SYSTEM32>\cacls.exe' <SYSTEM32>\com\smss.exe /e /t /g Everyone:F
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\com\smss.exe"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\com\lsass.exe"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\com\netcfg.000"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\com\netcfg.dll"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\dnsq.dll"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\com\bak"
'<SYSTEM32>\ping.exe' -f -n 1 www.ba##u.com
'<SYSTEM32>\rundll32.exe' "%ProgramFiles%\Microsoft Office\Office12\GrooveUtil.DLL",GetResourceModulePath trKTi/kNclGWvtoq0dvNv86qkSfdRUiU