Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%.exe
- C:\Documents and Settings\NetworkService\Favorites\Desktop.ini
- C:\System Volume Information.exe
- C:\RECYCLER.exe
- <Auxiliary element>
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FA1GMWW3\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\5ZKO9WQ9\aa[1].txt
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\OTMVO92Z\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\5ZKO9WQ9\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\4DMBWHEV\desktop.ini
- %PROGRAM_FILES%.exe
- <SYSTEM32>\system.exe
- <SYSTEM32>\svhost.exe
- %WINDIR%\Driver.db
- %WINDIR%\Tasks\At1.job
- C:\Far2.exe
- C:\<Auxiliary name>.exe
- C:\Documents and Settings.exe
- C:\startup.exe
- <Current directory>.exe
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Creates and executes the following:
- '<SYSTEM32>\commander.exe' /C <SYSTEM32>\system.exe copyc:\RECYCLER.exe
- '<SYSTEM32>\system.exe' copyc:\RECYCLER.exe
- '<SYSTEM32>\system.exe' copy%PROGRAM_FILES%.exe
- '<SYSTEM32>\system.exe' copyc:\<Auxiliary name>.exe
- '<SYSTEM32>\commander.exe' /C <SYSTEM32>\system.exe copy%PROGRAM_FILES%.exe
- '<SYSTEM32>\commander.exe' <Auxiliary element>
- '<SYSTEM32>\commander.exe' /C <SYSTEM32>\system.exe copy%WINDIR%.exe
- '<SYSTEM32>\system.exe' copy%WINDIR%.exe
- '<SYSTEM32>\system.exe' copyc:\System Volume Information.exe
- '<SYSTEM32>\system.exe' <Auxiliary element>
- '<SYSTEM32>\commander.exe' /C <SYSTEM32>\system.exe copyc:\System Volume Information.exe
- '<SYSTEM32>\commander.exe' /C <SYSTEM32>\system.exe copyc:\<Auxiliary name>.exe
- '<SYSTEM32>\commander.exe' /C <SYSTEM32>\system.exe copy\startup.exe
- '<SYSTEM32>\system.exe' copy\startup.exe
- '%WINDIR%\svhost.exe'
- '<SYSTEM32>\commander.exe' /C at 9:00 /interactive %WINDIR%\svhost.exe
- '<SYSTEM32>\commander.exe' /C schtasks /run /tn at1
- '<SYSTEM32>\commander.exe' /C <SYSTEM32>\system.exe copy<Current directory>.exe
- '<SYSTEM32>\commander.exe' /C <SYSTEM32>\system.exe copyc:\Far2.exe
- '<SYSTEM32>\system.exe' copyc:\Far2.exe
- '<SYSTEM32>\system.exe' copyc:\Documents and Settings.exe
- '<SYSTEM32>\system.exe' copy<Current directory>.exe
- '<SYSTEM32>\commander.exe' /C <SYSTEM32>\system.exe copyc:\Documents and Settings.exe
Executes the following:
- '<SYSTEM32>\schtasks.exe' /run /tn at1
- '<SYSTEM32>\at.exe' 9:00 /interactive %WINDIR%\svhost.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\commander.exe
- %WINDIR%\svhost.exe
Sets the 'hidden' attribute to the following files:
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\4DMBWHEV\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\OTMVO92Z\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FA1GMWW3\desktop.ini
- %WINDIR%\svhost.exe
- C:\Documents and Settings\NetworkService\Favorites\Desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\5ZKO9WQ9\desktop.ini
Deletes the following files:
- %WINDIR%\Tasks\SA.DAT
- %WINDIR%\Tasks\desktop.ini
Network activity:
Connects to:
- 'in#####e.freevnn.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- in#####e.freevnn.com/aa.txt
UDP:
- DNS ASK in#####e.freevnn.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
