Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Svchostt' = '%APPDATA%\svchostt\svchostt.exe run'
Modifies file system
Creates the following files
- %APPDATA%\svchostt\svchostt.exe
- %APPDATA%\svchostt\svchostt.ini
- %APPDATA%\svchostt\info.dlm
- %WINDIR%\temp\cabe4f3.tmp
- %WINDIR%\temp\tare4f4.tmp
- %WINDIR%\temp\3e698.mst
Sets the 'hidden' attribute to the following files
- %APPDATA%\svchostt\svchostt.exe
Deletes the following files
- %WINDIR%\temp\cabe4f3.tmp
- %WINDIR%\temp\tare4f4.tmp
- %WINDIR%\temp\3e698.mst
Network activity
Connects to
- 'microsoft.com':80
- 'ev######.ws.symantec.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://ev######.ws.symantec.com/evcs.crl
UDP
- DNS ASK microsoft.com
- DNS ASK ev######.ws.symantec.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\svchostt\svchostt.exe' run
- '%WINDIR%\syswow64\wbem\wmic.exe' /OUTPUT:Info.dlm PATH Win32_ComputerSystem GET Manufacturer,Model,Name /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_NetworkLoginProfile GET Caption,Lastlogoff,LastLogon,UserType /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_OperatingSystem GET Caption,CSDVersion,OSArchitecture,MUILanguages,OSLanguage,RegisteredUser,InstallDate /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_Processor GET Name,Manufacturer,MaxClockSpeed,DeviceID,NumberOfCores,MaxClockSpeed /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_PhysicalMemory GET Capacity,BankLabel,Manufacturer,Speed /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_DiskDrive GET Model,Size,serialnumber /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_LogicalDisk GET DeviceID,VolumeName,FileSystem,FreeSpace,Size /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_videocontroller GET description,VideoModeDescription,AdapterRAM /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_DesktopMonitor GET Caption,PNPDeviceID /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_Share GET Name,Path,Status,Description /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_UserAccount GET Name,Status,PasswordRequired /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_Printer GET DeviceID /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm STARTUP GET Caption,Command,Description,Location /FORMAT:LIST' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_Product GET InstallDate,Name,Version /FORMAT:LIST' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' /OUTPUT:Info.dlm PATH Win32_ComputerSystem GET Manufacturer,Model,Name /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_NetworkLoginProfile GET Caption,Lastlogoff,LastLogon,UserType /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_OperatingSystem GET Caption,CSDVersion,OSArchitecture,MUILanguages,OSLanguage,RegisteredUser,InstallDate /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_Processor GET Name,Manufacturer,MaxClockSpeed,DeviceID,NumberOfCores,MaxClockSpeed /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_PhysicalMemory GET Capacity,BankLabel,Manufacturer,Speed /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_DiskDrive GET Model,Size,serialnumber /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_LogicalDisk GET DeviceID,VolumeName,FileSystem,FreeSpace,Size /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_videocontroller GET description,VideoModeDescription,AdapterRAM /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_DesktopMonitor GET Caption,PNPDeviceID /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_Share GET Name,Path,Status,Description /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_UserAccount GET Name,Status,PasswordRequired /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_Printer GET DeviceID /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm STARTUP GET Caption,Command,Description,Location /FORMAT:LIST
- '%WINDIR%\syswow64\wbem\wmic.exe' /APPEND:Info.dlm PATH Win32_Product GET InstallDate,Name,Version /FORMAT:LIST
