Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] '209C4EA5E9DAA3DD' = 'C:\winsesrvice\winsesrvice.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\rundll32.exe
- %WINDIR%\syswow64\werfault.exe
the following user processes:
- winsesrvice.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\rundll32.exe
Modifies settings of Windows Internet Explorer
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPost' = '{00,00,00,00}'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1409' = '00000003'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1409' = '00000003'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1409' = '00000003'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1409' = '00000003'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1406' = '00000000'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1409' = '00000003'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1406' = '00000000'
Modifies file system
Creates the following files
- C:\winsesrvice\winsesrvice.exe
- C:\winsesrvice\config.bin
- %TEMP%\vvv5428.exe
Deletes itself.
Network activity
Connects to
- 'localhost':49185
- '19#.#4.185.132':2711
- '80.#0.2.109':455
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/
Other
- 'localhost':49185
UDP
- DNS ASK tv####unamus.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- 'C:\winsesrvice\winsesrvice.exe'
- '%TEMP%\vvv5428.exe'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
