Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\76b5b8f7b078a3e94bd4643b5be8cb\update\update.exe' /quiet
- '<SYSTEM32>\vhd\vhdmount.exe' /p vhd.vhd /f
- '<SYSTEM32>\vhd\devcon.exe' install vhdbus.inf root\vhdbus
- '%WINDIR%\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.5-WinXP.exe' Kernel-Mode Driver Framework Install-v1.5-WinXP.exe /quiet
Executes the following:
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\.vhd\shell\╣╥╜╙(&M)\command" /f /ve /t REG_SZ /d "vhdmount.exe /p \"%1\" /f"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\.vhd\shell\░╬│¤(&U)\command" /f /ve /t REG_SZ /d "vhdmount.exe /u \"%1\" /d"
- '<SYSTEM32>\rundll32.exe' newdev.dll,ClientSideInstall \\.\pipe\PNP_Device_Install_Pipe_0.{DF933022-C231-41D7-89D7-87E22F47F44F}
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\mode.com' con: cols=40 lines=2
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\vhd\setup.cmd" "
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\.vhd\DefaultIcon" /f /ve /t REG_SZ /d "<SYSTEM32>\vhd\vhd.ico"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\.vhd" /f /ve /t REG_SZ /d "╨щ─т╙▓┼╠"
Modifies file system :
Creates the following files:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\$NtUninstallWdf01005$\spuninst\Kmdfcustom.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- %WINDIR%\$NtUninstallWdf01005$\spuninst\spuninst.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %WINDIR%\inf\oem4.inf
- %WINDIR%\inf\oem4.PNF
- %WINDIR%\$NtUninstallWdf01005$\spuninst\spuninst.inf
- %WINDIR%\$NtUninstallWdf01005$\spuninst\updspapi.dll
- %WINDIR%\$NtUninstallWdf01005$\spuninst\spuninst.txt
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %TEMP%\Cab7.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %WINDIR%\Wdf01005.cat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- <DRIVERS>\SETA.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Wdf01005.cat
- <DRIVERS>\SET9.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- <SYSTEM32>\vhdmount.dll
- <SYSTEM32>\vhdmount.exe
- <SYSTEM32>\vhd\vhd.vhd
- <SYSTEM32>\vhd\vhdbus.sys
- <SYSTEM32>\vhd\vhdstor.sys
- <DRIVERS>\SET3.tmp
- <SYSTEM32>\SET4.tmp
- %WINDIR%\inf\oem3.PNF
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\inf\oem3.inf
- <SYSTEM32>\vhd\vhdstor.inf
- <SYSTEM32>\vhd\vhdmount.dll
- <SYSTEM32>\vhd\vhdstorlog.dll
- <SYSTEM32>\vhd\setup.cmd
- <SYSTEM32>\vhd\vhdbus.cat
- <SYSTEM32>\vhd\vhdstor.cat
- <SYSTEM32>\vhd\vhd.ico
- <SYSTEM32>\vhd\vhdbus.inf
- <SYSTEM32>\vhd\vhdmount.exe
- <SYSTEM32>\vhd\WdfCoInstaller01005.dll
- <SYSTEM32>\vhd\devcon.exe
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\updspapi.dll
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\update.exe
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\kmdfcustom.dll
- C:\76b5b8f7b078a3e94bd4643b5be8cb\wdfldr.sys
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\wdf01005.cat
- %WINDIR%\Wdf01005Inst.log
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- C:\76b5b8f7b078a3e94bd4643b5be8cb\$shtdwn$.req
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\update.inf
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\update.ver
- C:\76b5b8f7b078a3e94bd4643b5be8cb\wdf01000.sys
- %WINDIR%\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.5-WinXP.exe
- %WINDIR%\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.5-Srv2k3.exe
- %WINDIR%\Temp\WdfTemp\Wdf.cat
- %WINDIR%\Temp\WdfTemp\WDF.cab
- %WINDIR%\Temp\WdfTemp\Wdf01000.inf
- C:\76b5b8f7b078a3e94bd4643b5be8cb\spuninst.exe
- C:\76b5b8f7b078a3e94bd4643b5be8cb\spupdsvc.exe
- C:\76b5b8f7b078a3e94bd4643b5be8cb\spmsg.dll
- %WINDIR%\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.5-Win2k.exe
- C:\76b5b8f7b078a3e94bd4643b5be8cb\kmdfcustom.dll
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Wdf01005.cat
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Deletes the following files:
- C:\76b5b8f7b078a3e94bd4643b5be8cb\spmsg.dll
- C:\76b5b8f7b078a3e94bd4643b5be8cb\kmdfcustom.dll
- C:\76b5b8f7b078a3e94bd4643b5be8cb\spuninst.exe
- C:\76b5b8f7b078a3e94bd4643b5be8cb\wdf01000.sys
- C:\76b5b8f7b078a3e94bd4643b5be8cb\spupdsvc.exe
- %WINDIR%\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.5-Srv2k3.exe
- %WINDIR%\Temp\WdfTemp\Wdf.cat
- %WINDIR%\Temp\WdfTemp\Wdf01000.inf
- %WINDIR%\Temp\WdfTemp\WDF.cab
- %WINDIR%\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.5-Win2k.exe
- %WINDIR%\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.5-WinXP.exe
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\update.ver
- %WINDIR%\imsins.BAK
- %TEMP%\Cab7.tmp
- %WINDIR%\_000003_.tmp.dll
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\update.inf
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\wdf01005.cat
- C:\76b5b8f7b078a3e94bd4643b5be8cb\wdfldr.sys
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\kmdfcustom.dll
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\update.exe
- C:\76b5b8f7b078a3e94bd4643b5be8cb\update\updspapi.dll
Moves the following files:
- from <DRIVERS>\SET9.tmp to <DRIVERS>\wdfldr.sys
- from <DRIVERS>\SETA.tmp to <DRIVERS>\wdf01000.sys
- from %WINDIR%\Wdf01005.cat to %WINDIR%\_000003_.tmp.dll
- from <DRIVERS>\SET3.tmp to <DRIVERS>\vhdbus.sys
- from <SYSTEM32>\SET4.tmp to <SYSTEM32>\WdfCoInstaller01005.dll
Network activity:
Connects to:
- 'www.download.windowsupdate.com':80
- 'wp#d':80
TCP:
HTTP GET requests:
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- wp#d/wpad.dat
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'STUFF-BOOT' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
