Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\uvnc bvba\UltraVNC\vncviewer.exe' = '%PROGRAM_FILES%\uvnc bvba\UltraVNC\vncviewer.exe:*:Enabled:vncviewer.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\uvnc bvba\UltraVNC\winvnc.exe' = '%PROGRAM_FILES%\uvnc bvba\UltraVNC\winvnc.exe:*:Enabled:winvnc.exe'
Creates and executes the following:
- '%PROGRAM_FILES%\uvnc bvba\UltraVNC\setpasswd.exe'
- '%PROGRAM_FILES%\uvnc bvba\UltraVNC\setcad.exe'
- '%TEMP%\7zS1.tmp\UltraVNC_1_2_01_X86_Setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-S
- '%TEMP%\is-D1CDT.tmp\UltraVNC_1_2_01_X86_Setup.tmp' /SL5="$40092,3095337,349696,%TEMP%\7zS1.tmp\UltraVNC_1_2_01_X86_Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-S
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\uvnc bvba\UltraVNC\winvnc.exe" "winvnc.exe" ENABLE ALL
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\uvnc bvba\UltraVNC\vncviewer.exe" "vncviewer.exe" ENABLE ALL
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 5900 vnc5900
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 5800 vnc5800
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-DENR4.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-IGJ4U.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-E3ETQ.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-R73SC.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-MIRRP.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-N94R9.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-ETJVU.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-BRHKJ.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-H0OD8.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\unins000.msg
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Edit Settings.lnk
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\ultravnc.ini
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode Encrypt)).lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode).lnk
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-F81KJ.tmp
- %TEMP%\is-U0TI9.tmp\Vista.cjstyles
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-TP9BS.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-5QPDE.tmp
- %TEMP%\is-D1CDT.tmp\UltraVNC_1_2_01_X86_Setup.tmp
- %TEMP%\7zS1.tmp\UltraVNC_1_2_01_X86_Setup.exe
- %TEMP%\is-U0TI9.tmp\isskin.dll
- %TEMP%\is-U0TI9.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-NVUFB.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-NPRAS.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-QTJ4G.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-40OBD.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-63753.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-26U1M.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-BRAOR.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-JAENF.tmp
- %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-KFJC3.tmp
Deletes the following files:
- %TEMP%\is-D1CDT.tmp\UltraVNC_1_2_01_X86_Setup.tmp
- %TEMP%\7zS1.tmp\UltraVNC_1_2_01_X86_Setup.exe
- %TEMP%\is-U0TI9.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-U0TI9.tmp\isskin.dll
- %TEMP%\is-U0TI9.tmp\Vista.cjstyles
Moves the following files:
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-BRHKJ.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\MSLogonACL.exe
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-ETJVU.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\vncviewer.exe
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-MIRRP.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\authSSP.dll
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-40OBD.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\ldapauthnt4.dll
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-N94R9.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\ldapauth9x.dll
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-E3ETQ.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\testauth.exe
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-H0OD8.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\ultravnc.ini
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-R73SC.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\uvnc_settings.exe
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-IGJ4U.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\setcad.exe
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-DENR4.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\setpasswd.exe
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-63753.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\ldapauth.dll
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-NVUFB.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\Readme.txt
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-BRAOR.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\winvnc.exe
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-TP9BS.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\Licence.rtf
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-F81KJ.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\unins000.exe
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-5QPDE.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\Whatsnew.rtf
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-QTJ4G.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\authadmin.dll
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-NPRAS.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\workgrpdomnt4.dll
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-JAENF.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\logging.dll
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-26U1M.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\logmessages.dll
- from %PROGRAM_FILES%\uvnc bvba\UltraVNC\is-KFJC3.tmp to %PROGRAM_FILES%\uvnc bvba\UltraVNC\vnchooks.dll
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
