Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'winlogon' = 'C:\heap41a\svchost.exe C:\heap41a\std.txt'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'status' = 'present'
Creates the following files on removable media:
- <Drive name for removable media>:\autorun.inf
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Creates and executes the following:
- 'C:\heap41a\svchost.exe' C:\heap41a\script1.txt
- 'C:\heap41a\svchost.exe' C:\heap41a\reproduce.txt
- '%TEMP%\MicrosoftPowerPoint\svchost.exe' MicrosoftPowerPoint\install.txt
- 'C:\heap41a\svchost.exe' C:\heap41a\std.txt
Modifies file system :
Creates the following files:
- C:\heap41a\Icon.ico
- C:\heap41a\2.mp3
- C:\heap41a\drivelist.txt
- C:\heap41a\offspring\autorun.inf
- C:\heap41a\script1.txt
- C:\heap41a\std.txt
- C:\heap41a\reproduce.txt
- %TEMP%\MicrosoftPowerPoint\pathlist.txt
- %TEMP%\MicrosoftPowerPoint\Install.txt
- %TEMP%\MicrosoftPowerPoint\drivelist.txt
- %TEMP%\MicrosoftPowerPoint\svchost.exe
- C:\heap41a\svchost.exe
- %TEMP%\MicrosoftPowerPoint\2.mp3
- %TEMP%\MicrosoftPowerPoint\Icon.ico
Sets the 'hidden' attribute to the following files:
- C:\heap41a\offspring\autorun.inf
Miscellaneous:
Searches for the following windows:
- ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\script1.txt - AutoHotkey v1.0.46.08'
- ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\reproduce.txt - AutoHotkey v1.0.46.08'
- ClassName: 'AutoHotkey' WindowName: 'C:\heap41a\std.txt - AutoHotkey v1.0.46.08'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
