Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SynDemo.exe] 'Debugger' = 'ntsd -d # SynDemo.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ImeUtil.exe] 'Debugger' = 'ntsd -d # ImeUtil.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PinyinUp.exe] 'Debugger' = 'ntsd -d # PinyinUp.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQExternal.exe] 'Debugger' = 'ntsd -d # QQExternal.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LBSclient.exe] 'Debugger' = 'ntsd -d # LBSclient.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IPHacker30.exe] 'Debugger' = 'ntsd -d # IPHacker30.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SohuNews.exe] 'Debugger' = 'ntsd -d # SohuNews.exe '
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\txupd.exe] 'Debugger' = 'ntsd -d # txupd.exe '
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPYLiveup.exe] 'Debugger' = 'ntsd -d # QQPYLiveup.exe '
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCDetector.exe] 'Debugger' = 'ntsd -d # QQPCDetector.exe '
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\weday.exe] 'Debugger' = 'ntsd -d # weday.exe '
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\janisa.exe] 'Debugger' = 'ntsd -d # janisa.exe '
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safe.exe] 'Debugger' = 'ntsd -d # Safe.exe '
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ShellHWDetection] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\PolicyAgent] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -r "Block UDP/445" -f *+0:445:UDP -n BLOCK -x
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -r "Block UDP/139" -f *+0:139:UDP -n BLOCK -x
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -r "Block UDP/135" -f *+0:135:UDP -n BLOCK -x
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -r "Block UDP/1443" -f *+0:1443:UDP -n BLOCK -x
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -x
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -r "Block tcP/8444" -f *+0:8444:tcp -n BLOCK -x
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -r "Block UDP/1444" -f *+0:1444:UDP -n BLOCK -x
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -r "Block TCP/135" -f *+0:135:TCP -n BLOCK -x
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -o -x
- '<SYSTEM32>\ccmd.exe' <SYSTEM32>\jwlog.dll
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -r "Block TCP/139" -f *+0:139:TCP -n BLOCK -x
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -r "Block TCP/1444" -f *+0:1444:TCP -n BLOCK -x
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -r "Block TCP/1443" -f *+0:1443:TCP -n BLOCK -x
- '%WINDIR%\ipseccmd.exe' -w REG -p "jw Safe" -r "Block TCP/445" -f *+0:445:TCP -n BLOCK -x
Executes the following:
- '<SYSTEM32>\route.exe' /p add 58.221.39.212 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\route.exe' /p add 58.221.39.211 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\route.exe' /p add 58.221.39.210 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\route.exe' /p add 58.221.39.215 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\route.exe' /p add 58.221.39.214 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\route.exe' /p add 58.221.39.213 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\route.exe' /p add 58.221.39.206 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\route.exe' /p add 58.221.39.205 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\route.exe' /p add 58.221.39.204 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\route.exe' /p add 58.221.39.209 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\route.exe' /p add 58.221.39.208 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\route.exe' /p add 58.221.39.207 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\sc.exe' start PolicyAgent Services
- '<SYSTEM32>\sc.exe' config PolicyAgent start= auto
- '<SYSTEM32>\ping.exe' 127.1 -n 2
- '<SYSTEM32>\sc.exe' start ShellHWDetection
- '<SYSTEM32>\sc.exe' config ShellHWDetection start= AUTO
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers /f
- '<SYSTEM32>\regsvr32.exe' /u /s igfxpph.dll
- '<SYSTEM32>\route.exe' /p add 58.221.37.125 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\find.exe' /i "PolicyAgent"
- '<SYSTEM32>\sc.exe' query PolicyAgent
- '<SYSTEM32>\reg.exe' add HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\new /ve /d {D969A300-E7FF-11d0-A93B-00A0C90F2719}
- '<SYSTEM32>\route.exe' /p add 58.221.39.196 mask 255.255.255.255 192.168.1.0
- '<SYSTEM32>\reg.exe' add HKlM\SYSTEM\CurrentControlSet\Control\CrashControl /v "AutoReboot" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add HKlM\SYSTEM\ControlSet001\Control\CrashControl /v "AutoReboot" /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\QQ6697646.bat
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCDetector.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # QQPCDetector.exe " /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Blizzard Entertainment\Warcraft III\Sound" /v provider /t REG_SZ /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Blizzard Entertainment\Warcraft III\Sound" /v positional /t REG_SZ /d 0 /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings" /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats" /f
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SynDemo.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # SynDemo.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ImeUtil.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # ImeUtil.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PinyinUp.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # PinyinUp.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQExternal.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # QQExternal.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LBSclient.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # LBSclient.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IPHacker30.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # IPHacker30.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safe.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # Safe.exe " /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\txupd.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # txupd.exe " /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPYLiveup.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # QQPYLiveup.exe " /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SohuNews.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # SohuNews.exe " /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\weday.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # weday.exe " /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\janisa.exe" /v "Debugger" /t REG_SZ /d "ntsd -d # janisa.exe " /f
Forces autoplay for removable media.
Modifies file system :
Creates the following files:
- <SYSTEM32>\jwlog.dll
- <SYSTEM32>\ccmd.exe
- %WINDIR%\QQ6697646.bat
- %WINDIR%\winipsec.dll
- %WINDIR%\xplore.exe
- %WINDIR%\ipseccmd.exe
Deletes the following files:
- %WINDIR%\ipseccmd.exe
- %WINDIR%\xplore.exe
- %TEMP%\~DFA8B7.tmp
- %WINDIR%\winipsec.dll
- %WINDIR%\Tasks\SA.DAT
- %WINDIR%\Tasks\desktop.ini
- <SYSTEM32>\jwlog.dll
- <SYSTEM32>\ccmd.exe
