Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'kjzm' = '%WINDIR%\ES4\kjzm.exe'
- [<HKLM>\SOFTWARE\Classes\docxfile\shell\open\command] '' = '"%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"'
- [<HKLM>\SOFTWARE\Classes\http\shell\open\command] '' = '"%ProgramFiles%\internet explorer\iexplore.exe" -nohome'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'del_es4' = 'cmd.exe /c rd /s/q %WINDIR%\ES4'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks execution of the following system utilities:
- Windows Update
Executes the following
- '<SYSTEM32>\taskkill.exe' -f -im TsService.exe
- '<SYSTEM32>\taskkill.exe' -f -im Baidu.exe
- '<SYSTEM32>\taskkill.exe' -f -im BaiduClientRender.exe
- '<SYSTEM32>\taskkill.exe' -f -im QyKernel.exe
- '<SYSTEM32>\taskkill.exe' -f -im QQMGBWebserver.exe
- '<SYSTEM32>\taskkill.exe' -f -im XLLiveUD.exe
- '<SYSTEM32>\taskkill.exe' -f -im QQBrowser.exe
- '<SYSTEM32>\taskkill.exe' -f -im QQMicroGameBoxService.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\mmc.exe
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2500' = '00000003'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\aut18bd.tmp
- %WINDIR%\reboot.exe
- %TEMP%\aut53db.tmp
- %TEMP%\remove_2345_protect_x64.exe
- %TEMP%\aut5b5a.tmp
Deletes the following files
- %TEMP%\aut18bd.tmp
- %TEMP%\aut53db.tmp
- %WINDIR%\tasks\adobe flash player updater.job
- %WINDIR%\tasks\sa.dat
- <SYSTEM32>\tasks\adobe acrobat update task
- <SYSTEM32>\tasks\adobe flash player updater
- <DRIVERS>\etc\hosts
- %TEMP%\aut5b5a.tmp
- %TEMP%\remove_2345_protect_x64.exe
Substitutes the following files
- %ALLUSERSPROFILE%\ntuser.pol
- %HOMEPATH%\ntuser.pol
Deletes itself.
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\reboot.exe'
- '%TEMP%\remove_2345_protect_x64.exe'
- '<SYSTEM32>\cmd.exe' /c regsvr32 /u /s igfxpph.dll' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im QQMicroGameBoxService.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im QQMGBWebserver.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im XLLiveUD.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im QyKernel.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im BaiduClientRender.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im Baidu.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c gpupdate /force' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Full path to file>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config BITS start= DISABLED' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop BITS' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config wuauserv start= DISABLED' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "%TEMP%\remove_2345_protect_x64.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop wuauserv' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /timeout 6' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootmenupolicy legacy' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v IgfxTray /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v HotKeysCmds /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\new /ve /d {D969A300-E7FF-11d0-A93B-00A0C90F2719}' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg delete HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c regsvr32 /u /s atiacm64.dll' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c regsvr32 /u /s atiacmxx.dll' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c regsvr32 /u /s igfxsrvc.dll' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c regsvr32 /u /s nvcpl.dll' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im TsService.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im QQBrowser.exe' (with hidden window)
Executes the following
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\devmgmt.msc"
- '<SYSTEM32>\rundll32.exe' USER32.DLL,UpdatePerUserSystemParameters
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Full path to file>"
- '<SYSTEM32>\bcdedit.exe' /set {default} bootmenupolicy legacy
- '<SYSTEM32>\sc.exe' stop BITS
- '<SYSTEM32>\sc.exe' config BITS start= DISABLED
- '<SYSTEM32>\sc.exe' config wuauserv start= DISABLED
- '<SYSTEM32>\bcdedit.exe' /timeout 6
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\cmd.exe' /c reg delete HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers /f
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im Baidu.exe
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im BaiduClientRender.exe
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im QyKernel.exe
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im XLLiveUD.exe
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im QQMGBWebserver.exe
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im QQMicroGameBoxService.exe
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im TsService.exe
- '<SYSTEM32>\cmd.exe' /c taskkill -f -im QQBrowser.exe
- '<SYSTEM32>\cmd.exe' /c sc stop BITS
- '<SYSTEM32>\cmd.exe' /c sc config BITS start= DISABLED
- '<SYSTEM32>\cmd.exe' /c sc config wuauserv start= DISABLED
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "%TEMP%\remove_2345_protect_x64.exe"
- '<SYSTEM32>\cmd.exe' /c sc stop wuauserv
- '<SYSTEM32>\regsvr32.exe' /u /s igfxpph.dll
- '<SYSTEM32>\cmd.exe' /c regsvr32 /u /s nvcpl.dll
- '<SYSTEM32>\regsvr32.exe' /u /s nvcpl.dll
- '<SYSTEM32>\cmd.exe' /c regsvr32 /u /s igfxsrvc.dll
- '<SYSTEM32>\regsvr32.exe' /u /s igfxsrvc.dll
- '<SYSTEM32>\cmd.exe' /c regsvr32 /u /s atiacmxx.dll
- '<SYSTEM32>\regsvr32.exe' /u /s atiacmxx.dll
- '<SYSTEM32>\cmd.exe' /c regsvr32 /u /s atiacm64.dll
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\cmd.exe' /c gpupdate /force
- '<SYSTEM32>\regsvr32.exe' /u /s atiacm64.dll
- '<SYSTEM32>\cmd.exe' /c reg add HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\new /ve /d {D969A300-E7FF-11d0-A93B-00A0C90F2719}
- '<SYSTEM32>\reg.exe' add HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\new /ve /d {D969A300-E7FF-11d0-A93B-00A0C90F2719}
- '<SYSTEM32>\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v HotKeysCmds /f
- '<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v HotKeysCmds /f
- '<SYSTEM32>\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v IgfxTray /f
- '<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v IgfxTray /f
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootmenupolicy legacy
- '<SYSTEM32>\cmd.exe' /c bcdedit /timeout 6
- '<SYSTEM32>\cmd.exe' /c regsvr32 /u /s igfxpph.dll
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers /f
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
Attempts to shut down the Windows operating system.
