Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'tvncontrol' = '"%WINDIR%\LTsvc\tvnserver.exe" -controlservice -slave'
Creates or modifies the following files
- %ALLUSERSPROFILE%\start menu\programs\startup\network monitoring tray.lnk
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\LTService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\LTService] 'ImagePath' = '"%WINDIR%\LTSvc\LTSVC.exe"'
- [<HKLM>\System\CurrentControlSet\Services\LTService] 'ImagePath' = '"%WINDIR%\LTSvc\LTSVC.exe" -sLTService'
- [<HKLM>\System\CurrentControlSet\Services\tvnserver] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\tvnserver] 'ImagePath' = '"%WINDIR%\LTsvc\tvnserver.exe" -service'
- [<HKLM>\System\CurrentControlSet\Services\cpuz148] 'ImagePath' = '%WINDIR%\temp\cpuz148\cpuz148_x32.sys'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\LTSvc\LTSVC.exe' = '%WINDIR%\LTSvc\LTSVC.exe:*:Enabled:Ag...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\LTSvc\LTTray.exe' = '%WINDIR%\LTSvc\LTTray.exe:*:Enabled:...
Executes the following
- '<SYSTEM32>\net.exe' Stop labvnc
- '<SYSTEM32>\netsh.exe' firewall set portopening udp 42000 allowagent enable subnet
- '<SYSTEM32>\netsh.exe' firewall set portopening udp 42001 allowagent enable subnet
- '<SYSTEM32>\netsh.exe' firewall set portopening udp 42002 allowagent enable subnet
- '<SYSTEM32>\netsh.exe' firewall set portopening udp 42003 allowagent enable subnet
- '<SYSTEM32>\netsh.exe' firewall set portopening udp 42004 allowagent enable subnet
- '<SYSTEM32>\netsh.exe' firewall set portopening udp 162 allowagent enable subnet
- '<SYSTEM32>\netsh.exe' firewall set portopening tcp 4999 allowagent enable custom 127.0.0.1,localsubnet
- '<SYSTEM32>\netsh.exe' firewall set portopening tcp 4998 allowagent enable custom 127.0.0.1,localsubnet
- '<SYSTEM32>\netsh.exe' firewall set portopening tcp 4997 allowagent enable custom 127.0.0.1,localsubnet
- '<SYSTEM32>\netsh.exe' firewall set portopening tcp 4996 allowagent enable custom 127.0.0.1,localsubnet
- '<SYSTEM32>\netsh.exe' firewall set allowedprogram %WINDIR%\LTsvc\LTSVC.exe AgentService ENABLE
- '<SYSTEM32>\netsh.exe' firewall set allowedprogram %WINDIR%\LTsvc\LTSVCmon.exe AgentMonitor ENABLE
- '<SYSTEM32>\netsh.exe' firewall set allowedprogram %WINDIR%\LTsvc\LTTray.exe AgentTray ENABLE
Modifies file system
Creates the following files
- <Current directory>\installlog.txt
- %WINDIR%\ltsvc\noshadow
- %WINDIR%\ltsvc\setcad.exe
- %WINDIR%\ltsvc\interop.wodvpn.dll
- %WINDIR%\ltsvc\interop.wuapilib.dll
- %WINDIR%\ltsvc\lsr.exe
- %WINDIR%\ltsvc\sas.dll
- %WINDIR%\ltsvc\system.data.sqlite.dll
- %WINDIR%\ltsvc\sqlite.interop.dll
- %WINDIR%\ltsvc\devp2p.dll
- %WINDIR%\ltsvc\labtechcommon.dll
- %WINDIR%\ltsvc\wbem-sharp.dll
- %WINDIR%\ltsvc\plugins\screenconnectremoteplugin.dll
- %WINDIR%\ltsvc\labvnc.ini
- %WINDIR%\ltsvc\ultravnc.ini
- %WINDIR%\ltsvc\nosensors
- %WINDIR%\temp\cpuz148\cpuz148_x32.sys
- %TEMP%\lterrors.txt
- <SYSTEM32>\config\systemprofile\application data\microsoft\cryptneturlcache\metadata\74bfd122c0875ec75dbe5c6db4c59019
- <SYSTEM32>\config\systemprofile\application data\microsoft\cryptneturlcache\content\74bfd122c0875ec75dbe5c6db4c59019
- <SYSTEM32>\config\systemprofile\application data\microsoft\cryptneturlcache\metadata\486cc6afd08942336c61fcd401c4a1d1
- <SYSTEM32>\config\systemprofile\application data\microsoft\cryptneturlcache\content\486cc6afd08942336c61fcd401c4a1d1
- %WINDIR%\ltsvc\lterrors.txt
- %WINDIR%\temp\perflib_perfdata_164.dat
- %WINDIR%\ltsvc\ltsvc.installstate
- %WINDIR%\ltsvc\ltsvc.installlog
- %WINDIR%\ltsvc\labtech.ico
- %WINDIR%\ltsvc\ltsvc.exe
- %WINDIR%\ltsvc\lttray.exe
- %WINDIR%\ltsvc\interfaces.dll
- %WINDIR%\ltsvc\cad.exe
- %WINDIR%\ltsvc\cpuidsdk.dll
- %WINDIR%\ltsvc\icsharpcode.sharpziplib.dll
- %WINDIR%\ltsvc\interop.wodvpncomlib.dll
- %WINDIR%\ltsvc\labvnc.exe
- %WINDIR%\ltsvc\nsoftware.ipworks.dll
- %WINDIR%\ltsvc\nsoftware.ipworksssh.dll
- %WINDIR%\ltsvc\nsoftware.ipworksssnmp.dll
- %WINDIR%\ltsvc\nsoftware.system.dll
- %WINDIR%\ltsvc\ps.exe
- %WINDIR%\ltsvc\schook.dll
- %WINDIR%\ltsvc\screenhooks.dll
- %WINDIR%\ltsvc\screenhooks32.dll
- %WINDIR%\ltsvc\tvnserver.exe
- %WINDIR%\ltsvc\vnchooks.dll
- %WINDIR%\ltsvc\wodvpn.dll
- <Current directory>\installutil.installlog
- <SYSTEM32>\config\rmm syst.evt
- %WINDIR%\ltsvc\plugin_scr.log
Deletes the following files
- %WINDIR%\ltsvc\interfaces.dll
- %WINDIR%\ltsvc\ltsvc.installlog
- %WINDIR%\ltsvc\noshadow
- <SYSTEM32>\wbem\logs\framework.log
- %WINDIR%\ltsvc\nosensors
Network activity
TCP
HTTP GET requests
- http://la####h.knet.com.au/labtech/updates/ForceUpdate.cst
- http://la####h.knet.com.au/LabTech/Agent.Aspx?De########################
- http://la####h.knet.com.au/LabTech/Agent.Aspx?De#########################
- http://la####h.knet.com.au/LabTech/Agent.Aspx?De##########################
- http://cr#.#hawte.com/ThawtePremiumServerCA.crl
- http://cr#.#hawte.com/ThawteCodeSigningCA.crl
- http://la####h.knet.com.au/LabTech/agent.aspx?0t#
- http://la####h.knet.com.au/LabTech/Agent.Aspx?De#######################
HTTP POST requests
- http://la####h.knet.com.au/LabTech/Agent.aspx?DE##
UDP
- DNS ASK la####h.knet.com.au
- DNS ASK cr#.#hawte.com
- DNS ASK kn##.#ostedrmm.com
- 'localhost':161
Miscellaneous
Creates and executes the following
- '%WINDIR%\ltsvc\ltsvc.exe'
- '%WINDIR%\ltsvc\tvnserver.exe' -install -silent
- '%WINDIR%\ltsvc\tvnserver.exe' -start -silent
- '%WINDIR%\ltsvc\tvnserver.exe' -service
- '%WINDIR%\ltsvc\tvnserver.exe' -controlservice -slave
- '%WINDIR%\ltsvc\lttray.exe'
- '%WINDIR%\ltsvc\tvnserver.exe' -stop -silent
- '%WINDIR%\ltsvc\tvnserver.exe' -remove -silent
- '%WINDIR%\microsoft.net\framework\v2.0.50727\installutil.exe' /name=LTService /account=localsystem %WINDIR%\LTSvc\LTSVC.exe' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\installutil.exe' /name=LTService /account=localsystem %WINDIR%\LTSvc\LTSVC.exe
- '<SYSTEM32>\cmd.exe' /c netsh firewall set allowedprogram %Windir%\LTsvc\LTSVC.exe AgentService ENABLE
- '<SYSTEM32>\cmd.exe' /c netsh firewall set portopening tcp 4996 allowagent enable custom 127.0.0.1,localsubnet
- '<SYSTEM32>\cmd.exe' /c netsh firewall set portopening tcp 4997 allowagent enable custom 127.0.0.1,localsubnet
- '<SYSTEM32>\wbem\wmiapsrv.exe'
- '<SYSTEM32>\cmd.exe' /c netsh firewall set portopening tcp 4998 allowagent enable custom 127.0.0.1,localsubnet
- '<SYSTEM32>\cmd.exe' /c netsh firewall set portopening tcp 4999 allowagent enable custom 127.0.0.1,localsubnet
- '<SYSTEM32>\cmd.exe' /c netsh firewall set portopening udp 162 allowagent enable subnet
- '<SYSTEM32>\cmd.exe' /c netsh firewall set portopening udp 42004 allowagent enable subnet
- '<SYSTEM32>\cmd.exe' /c netsh firewall set portopening udp 42003 allowagent enable subnet
- '<SYSTEM32>\cmd.exe' /c netsh firewall set portopening udp 42002 allowagent enable subnet
- '<SYSTEM32>\cmd.exe' /c netsh firewall set portopening udp 42001 allowagent enable subnet
- '<SYSTEM32>\cmd.exe' /c netsh firewall set allowedprogram %Windir%\LTsvc\LTSVCmon.exe AgentMonitor ENABLE
- '<SYSTEM32>\cmd.exe' /c netsh firewall set portopening udp 42000 allowagent enable subnet
- '<SYSTEM32>\net.exe' Start LTSvcMon
- '<SYSTEM32>\cmd.exe' /c NET Start LTSvcMon
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\LTsvc\wodVPN.dll"
- '<SYSTEM32>\cacls.exe' %WINDIR%\Temp /E /G Everyone:F
- '<SYSTEM32>\verclsid.exe' /C {B5A7F190-DDA6-4420-B3BA-52453494E6CD} /I {00000000-0000-0000-C000-000000000046} /X 0x401
- '<SYSTEM32>\net1.exe' Stop PSEXESVC
- '<SYSTEM32>\net1.exe' Start labvnc
- '<SYSTEM32>\net.exe' Start labvnc
- '<SYSTEM32>\cmd.exe' /c NET Start labvnc
- '<SYSTEM32>\net1.exe' Stop labvnc
- '<SYSTEM32>\cmd.exe' /c NET Stop labvnc
- '<SYSTEM32>\net1.exe' Start LTSvcMon
- '<SYSTEM32>\cmd.exe' /c netsh firewall set allowedprogram %Windir%\LTsvc\LTTray.exe AgentTray ENABLE
