Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'service' = '%WINDIR%\TEMP\svchost.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop SharedAccess
- '%WINDIR%\syswow64\net.exe' stop MpsSvc
Modifies file system
Creates the following files
- %WINDIR%\temp\svchost.exe
Network activity
UDP
- DNS ASK pa####esoftware.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\net.exe' stop SharedAccess' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop MpsSvc' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\net1.exe' stop SharedAccess
- '%WINDIR%\syswow64\net1.exe' stop MpsSvc
