Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] '{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}' = 'fffifile.dll'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%PROGRAM_FILES%\svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] '{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}' = 'csiddll'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Comeventps] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\mnmsrvc] 'Start' = '00000002'
Infects the following executable system files:
- <SYSTEM32>\appmgmts.dll
Substitutes the following executable system files:
- <SYSTEM32>\mnmsrvc.exe with <SYSTEM32>\mnmsrvc.exe
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Creates and executes the following:
- %TEMP%\Messenger\setup.exe m2_ss
- <SYSTEM32>\plifc.exe
- %PROGRAM_FILES%\Microsoft Office\SYSTEM\sysbar.exe
- <DRIVERS>\etc\xiaoyao.exe "%PROGRAM_FILES%\svchost.exe"
- %TEMP%\ok.exe
- <SYSTEM32>\fake.exe
- <SYSTEM32>\korux.exe
- %TEMP%\syslive_niu2.exe
- <SYSTEM32>\korux.exe /service
- <DRIVERS>\etc\ctfmon.exe
- <DRIVERS>\etc\lsass.exe
- <DRIVERS>\etc\alg.exe
- <DRIVERS>\etc\hqtray.exe
- <DRIVERS>\etc\User3.exe
- <DRIVERS>\etc\svchost.exe
- <DRIVERS>\etc\taskmgr.exe
- <DRIVERS>\etc\smss.exe
- <DRIVERS>\etc\xiaoyao.exe
Executes the following:
- <SYSTEM32>\cmd.exe /c 375519961O57540.bat
- <SYSTEM32>\cmd.exe /c ""%TEMP%\ope6.bat" "" "<DRIVERS>\etc" "taskmgr.exe""
- <SYSTEM32>\net1.exe start Comeventps
- <SYSTEM32>\cmd.exe /c %TEMP%\Cls.bat
- <SYSTEM32>\regsvr32.exe /s <SYSTEM32>\fffifile.dll
- <SYSTEM32>\regsvr32.exe "%TEMP%\Messenger\ThunderSafe.dll" /s
- <SYSTEM32>\rundll32.exe try4719.dll , InstallMyDll
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %PROGRAM_FILES%\avicap.dll
Searches for windows to
bypass Windows Files Protection (WFP):
- ClassName: '#32770' WindowName: 'Windows File Protection'
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Microsoft Office\SYSTEM\03.exe
- %TEMP%\nsa4.tmp\System.dll
- %PROGRAM_FILES%\obj.bin
- <SYSTEM32>\mssrcid.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\_inimac
- %TEMP%\Messenger\sysmain.dat
- %TEMP%\Messenger\setup.exe
- %TEMP%\Messenger\sysvc.dat
- %TEMP%\ok.exe
- %PROGRAM_FILES%\obj.txt
- %TEMP%\syslive_niu2.exe
- <DRIVERS>\etc\57540.aqq
- <DRIVERS>\etc\375519961O57540.bat
- %WINDIR%\aaa\solotan.exe
- %WINDIR%\aaa\skyxpserver.exe
- %WINDIR%\aaa\goooke.exe
- %TEMP%\ope6.bat
- %TEMP%\Cls.bat
- <SYSTEM32>\fake.exe
- <SYSTEM32>\Web.ini
- %TEMP%\{B8DF0511-8A07-4F3C-B07A-356FC729594F}.txt
- <DRIVERS>\etc\User3.exe
- <DRIVERS>\etc\xiaoyao.exe
- <DRIVERS>\etc\taskmgr.exe
- <SYSTEM32>\try4719.dll
- <DRIVERS>\etc\smss.exe
- <DRIVERS>\etc\alg.exe
- <DRIVERS>\etc\svchost.exe
- <DRIVERS>\etc\hqtray.exe
- <DRIVERS>\etc\ctfmon.exe
- <DRIVERS>\etc\lsass.exe
- <SYSTEM32>\dllcache\try4719.dll
- %TEMP%\Messenger\ThunderSafe.dll
- %PROGRAM_FILES%\cfg.bin
- %TEMP%\Messenger\ccfapi32.dll
- %TEMP%\Messenger\nvsys.ini
- %TEMP%\Messenger\ccfapi321.dll
- <SYSTEM32>\00000000000188e6680f50.dat
- <SYSTEM32>\fffifile.dll
- %PROGRAM_FILES%\_tmp.txt
- %PROGRAM_FILES%\Windows Media Player\ycbdf.exe
Sets the 'hidden' attribute to the following files:
- %PROGRAM_FILES%\obj.bin
- %PROGRAM_FILES%\svchost.exe
- %PROGRAM_FILES%\cfg.bin
- <DRIVERS>\etc\xiaoyao.exe
- %PROGRAM_FILES%\Windows Media Player\ycbdf.exe
- <SYSTEM32>\00000000000188e6680f50.dat
- %PROGRAM_FILES%\avicap.dll
- <DRIVERS>\etc\User3.exe
Deletes the following files:
- <DRIVERS>\etc\taskmgr.exe
- %TEMP%\ok.exe
- <DRIVERS>\etc\lsass.exe
- <DRIVERS>\etc\57540.aqq
- %PROGRAM_FILES%\_tmp.txt
- <SYSTEM32>\dllcache\mnmsrvc.exe
- <SYSTEM32>\fake.exe
- %TEMP%\nsa4.tmp\System.dll
Moves the following system files:
- from <SYSTEM32>\mnmsrvc.exe to <SYSTEM32>\mnmsrvc.exe.bak
Moves the following files:
- from %TEMP%\Messenger\sysvc.dat to <SYSTEM32>\korux.exe
- from %TEMP%\Messenger\nvsys.ini to <SYSTEM32>\qmjgd.ini
- from %TEMP%\Messenger\sysmain.dat to <SYSTEM32>\plifc.exe
- from %PROGRAM_FILES%\obj.txt to %PROGRAM_FILES%\avicap.dll
- from %PROGRAM_FILES%\obj.txt to %PROGRAM_FILES%\svchost.exe
- from %PROGRAM_FILES%\Microsoft Office\SYSTEM\03.exe to %PROGRAM_FILES%\Microsoft Office\SYSTEM\sysbar.exe
Network activity:
Connects to:
- 'ad.##595.com':80
TCP:
HTTP GET requests:
- ad.##595.com/come/bho.asp
UDP:
- DNS ASK ad.##595.com
Miscellaneous:
Searches for the following windows:
- ClassName: '#32770' WindowName: 'Windows ????????'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
