Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\MetPipAtcivator] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\MetPipAtcivator] 'ImagePath' = '%WINDIR%\Fonts\svchost.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop MetPipAtcivator
- '%WINDIR%\syswow64\net.exe' stop SetPipAtcivator
- '%WINDIR%\syswow64\net.exe' stop lanmanserver /y
- '%WINDIR%\syswow64\net.exe' stop mssecsvc2.0
- '%WINDIR%\syswow64\net.exe' stop mssecsvc2.1
Modifies file system
Creates the following files
- %WINDIR%\fonts\svchost.exe
- %WINDIR%\fonts\conhost.exe
- <Current directory>\tem.vbs
Sets the 'hidden' attribute to the following files
- %WINDIR%\fonts\conhost.exe
- %WINDIR%\fonts\svchost.exe
- <Current directory>\tem.vbs
Deletes the following files
- <Current directory>\tem.vbs
Deletes itself.
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "<Current directory>\tem.vbs"
- '%WINDIR%\fonts\svchost.exe' start MetPipAtcivator
- '%WINDIR%\fonts\svchost.exe' set MetPipAtcivator Description Provides performance library information from Windows Management.
- '%WINDIR%\fonts\svchost.exe' set MetPipAtcivator DisplayName Network Location Service
- '%WINDIR%\fonts\svchost.exe' install MetPipAtcivator %WINDIR%\Fonts\conhost.exe
- '%WINDIR%\fonts\svchost.exe' set MetPipAtcivator Description Provides performance library information from Windows Management.' (with hidden window)
- '%WINDIR%\fonts\svchost.exe' set MetPipAtcivator DisplayName Network Location Service' (with hidden window)
- '%WINDIR%\fonts\svchost.exe' install MetPipAtcivator %WINDIR%\Fonts\conhost.exe' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete mssecsvc2.1' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop mssecsvc2.1' (with hidden window)
- '%WINDIR%\fonts\svchost.exe' start MetPipAtcivator' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop mssecsvc2.0' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete mssecsvc2.0' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete lanmanserver' (with hidden window)
- '%WINDIR%\syswow64\net1.exe' user mm123$ /del' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config lanmanserver start= DISABLED 2>nul' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop lanmanserver /y' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete SetPipAtcivator' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop SetPipAtcivator' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete MetPipAtcivator' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop MetPipAtcivator' (with hidden window)
- '%WINDIR%\syswow64\net.exe' user mm123$ /del' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c attrib -s -h -r -a %WINDIR%\Fonts' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c attrib -s -h -r -a %WINDIR%\Fonts
- '%WINDIR%\syswow64\sc.exe' delete MetPipAtcivator
- '%WINDIR%\syswow64\sc.exe' delete SetPipAtcivator
- '%WINDIR%\syswow64\sc.exe' config lanmanserver start= DISABLED 2>nul
- '%WINDIR%\syswow64\sc.exe' delete lanmanserver
- '%WINDIR%\syswow64\net.exe' user mm123$ /del
- '%WINDIR%\syswow64\net1.exe' user mm123$ /del
- '%WINDIR%\syswow64\sc.exe' delete mssecsvc2.0
- '%WINDIR%\syswow64\sc.exe' delete mssecsvc2.1
- '%WINDIR%\syswow64\attrib.exe' -s -h -r -a %WINDIR%\Fonts
- '%WINDIR%\syswow64\net1.exe' stop SetPipAtcivator
- '%WINDIR%\syswow64\net1.exe' stop lanmanserver /y
- '%WINDIR%\syswow64\net1.exe' stop MetPipAtcivator
- '%WINDIR%\syswow64\net1.exe' stop mssecsvc2.0
- '%WINDIR%\syswow64\net1.exe' stop mssecsvc2.1
