Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Broadcom Wireless Manager UI' = '"%CommonProgramFiles%\Microsoft Shared\ink\pl-PL\bcmntray.exe"'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Java(TM) Platform SE Auto Updater' = '"%CommonProgramFiles%\Microsoft Shared\Smart Tag\LISTS\1033\jusched.exe"'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'AutoUpdate Monitor' = '"%APPDATA%\Thunderbird\Pending Pings\almon.exe"'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Microsoft Office 2007' = '"%ProgramFiles%\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\BCSSync.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\broadcom wireless manager ui
- <SYSTEM32>\tasks\java(tm) platform se auto updater
- <SYSTEM32>\tasks\autoupdate monitor
- <SYSTEM32>\tasks\microsoft office 2007
- <SYSTEM32>\tasks\accessmanager
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=DISABLE
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %APPDATA%\mozilla\firefox\plugin-container.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\plugin-container.exe
- %CommonProgramFiles%\microsoft shared\ink\pl-pl\~xlnhdvm.tmp
- %CommonProgramFiles%\microsoft shared\ink\pl-pl\bcmntray.exe
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\~aicxwpl.tmp
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\jusched.exe
- %APPDATA%\thunderbird\pending pings\~rmyuisx.tmp
- %APPDATA%\thunderbird\pending pings\almon.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\~uppdnfu.tmp
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\bcssync.exe
- %ProgramFiles%\msbuild\microsoft\windows workflow foundation\~tenyzif.tmp
- %ProgramFiles%\msbuild\microsoft\windows workflow foundation\accessmgr.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\~tpjctnf.tmp
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\clpsla.exe
Deletes the following files
- %APPDATA%\mozilla\firefox\plugin-container.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\plugin-container.exe
- %CommonProgramFiles%\microsoft shared\ink\pl-pl\~xlnhdvm.tmp
- %CommonProgramFiles%\microsoft shared\ink\pl-pl\bcmntray.exe
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\~aicxwpl.tmp
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\jusched.exe
- %APPDATA%\thunderbird\pending pings\~rmyuisx.tmp
- %APPDATA%\thunderbird\pending pings\almon.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\~uppdnfu.tmp
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\bcssync.exe
- %ProgramFiles%\msbuild\microsoft\windows workflow foundation\~tenyzif.tmp
- %ProgramFiles%\msbuild\microsoft\windows workflow foundation\accessmgr.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\~tpjctnf.tmp
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\clpsla.exe
Substitutes the following files
- %APPDATA%\mozilla\firefox\plugin-container.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\plugin-container.exe
- %CommonProgramFiles%\microsoft shared\ink\pl-pl\bcmntray.exe
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\jusched.exe
- %APPDATA%\thunderbird\pending pings\almon.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\bcssync.exe
- %ProgramFiles%\msbuild\microsoft\windows workflow foundation\accessmgr.exe
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\clpsla.exe
- %CommonProgramFiles%\microsoft shared\ink\pl-pl\~xlnhdvm.tmp
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\~aicxwpl.tmp
- %APPDATA%\thunderbird\pending pings\~rmyuisx.tmp
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\~uppdnfu.tmp
- %ProgramFiles%\msbuild\microsoft\windows workflow foundation\~tenyzif.tmp
- %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\lime\~tpjctnf.tmp
Network activity
UDP
- 'localhost':50124
- 'localhost':58559
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /C DIR /A:D /S /B *
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 11 /TN "Broadcom Wireless Manager UI" /TR "\"%CommonProgramFiles%\Microsoft Shared\ink\pl-PL\bcmntray.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 21 /TN "Java(TM) Platform SE Auto Updater" /TR "\"%CommonProgramFiles%\Microsoft Shared\Smart Tag\LISTS\1033\jusched.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 26 /TN "AutoUpdate Monitor" /TR "\"%APPDATA%\Thunderbird\Pending Pings\almon.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 9 /TN "Microsoft Office 2007" /TR "\"%ProgramFiles%\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\BCSSync.exe\""
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "AccessManager" /TR "\"%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\AccessMgr.exe\""
- '<SYSTEM32>\cmd.exe' /C DIR /A:D /S /B *' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 11 /TN "Broadcom Wireless Manager UI" /TR "\"%CommonProgramFiles%\Microsoft Shared\ink\pl-PL\bcmntray.exe\""' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 21 /TN "Java(TM) Platform SE Auto Updater" /TR "\"%CommonProgramFiles%\Microsoft Shared\Smart Tag\LISTS\1033\jusched.exe\""' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 26 /TN "AutoUpdate Monitor" /TR "\"%APPDATA%\Thunderbird\Pending Pings\almon.exe\""' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC MINUTE /MO 9 /TN "Microsoft Office 2007" /TR "\"%ProgramFiles%\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\BCSSync.exe\""' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "AccessManager" /TR "\"%ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\AccessMgr.exe\""' (with hidden window)
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=DISABLE' (with hidden window)
