Trojan.KillFiles.12748

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\seclogon] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\RpcSs] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\SamSs] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\Themes] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\winmgmt] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\SENS] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ShellHWDetection] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\dmserver] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\Dnscache] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\AudioSrv] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\DcomLaunch] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\PlugPlay] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ProtectedStorage] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\Eventlog] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\lanmanworkstation] 'Start' = '00000002'

Malicious functions:

Executes the following:

'<SYSTEM32>\sc.exe' config WmdmPmSN start= DISABLED
'<SYSTEM32>\sc.exe' config Wmi start= DEMAND
'<SYSTEM32>\sc.exe' config WmiApSrv start= DISABLED
'<SYSTEM32>\sc.exe' config W32Time start= DISABLED
'<SYSTEM32>\sc.exe' config WebClient start= DISABLED
'<SYSTEM32>\sc.exe' config winmgmt start= AUTO
'<SYSTEM32>\sc.exe' config wuauserv start= DISABLED
'<SYSTEM32>\sc.exe' config SSDPSRV start= DISABLED
'<SYSTEM32>\sc.exe' config TlntSvr start= DISABLED
'<SYSTEM32>\sc.exe' config upnphost start= DEMAND
'<SYSTEM32>\sc.exe' config xmlprov start= DEMAND
'<SYSTEM32>\sc.exe' config FastUserSwitchingCompatibility start= DEMAND
'<SYSTEM32>\sc.exe' config srservice start= DISABLED
'<SYSTEM32>\sc.exe' config stisvc start= DEMAND
'<SYSTEM32>\sc.exe' config swprv start= DISABLED
'<SYSTEM32>\sc.exe' config SysmonLog start= DISABLED
'<SYSTEM32>\sc.exe' config SharedAccess start= DEMAND
'<SYSTEM32>\sc.exe' config ShellHWDetection start= AUTO
'<SYSTEM32>\sc.exe' config Spooler start= DEMAND
'<SYSTEM32>\sc.exe' config TapiSrv start= DEMAND
'<SYSTEM32>\sc.exe' config UMWdf start= DEMAND
'<SYSTEM32>\sc.exe' config UPS start= DISABLED
'<SYSTEM32>\sc.exe' config VSS start= DISABLED
'<SYSTEM32>\sc.exe' config TermService start= DISABLED
'<SYSTEM32>\sc.exe' config Themes start= AUTO
'<SYSTEM32>\sc.exe' config TrkWks start= DISABLED
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v hkey /d HKLM
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v inimapping /d 0
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v item /d TINTSETP
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v key /d SOFTWARE\Microsoft\Windows\CurrentVersion\Run
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A"
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v command /d "<SYSTEM32>\IME\TINTLGNT\TINTSETP.EXE /IMEName"
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v key /d SOFTWARE\Microsoft\Windows\CurrentVersion\Run
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v inimapping /d 0
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v item /d TINTSETP
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v key /d SOFTWARE\Microsoft\Windows\CurrentVersion\Run
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync"
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v command /d ""%WINDIR%\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32"
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v hkey /d HKLM
'<SYSTEM32>\reg.exe' add HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\new /ve /d {D969A300-E7FF-11d0-A93B-00A0C90F2719}
'<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
'<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /va /f
'<SYSTEM32>\sc.exe' config wscsvc start= DISABLED
'<SYSTEM32>\regsvr32.exe' /u /s igfxpph.dll
'<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers /f
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v ctfmon.exe /d <SYSTEM32>\ctfmon.exe
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v hkey /d HKLM
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v inimapping /d 0
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v item /d IMJPMIG
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1"
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v command /d ""%WINDIR%\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32"
'<SYSTEM32>\sc.exe' config SENS start= AUTO
'<SYSTEM32>\sc.exe' config ERSvc start= DISABLED
'<SYSTEM32>\sc.exe' config Eventlog start= AUTO
'<SYSTEM32>\sc.exe' config EventSystem start= DEMAND
'<SYSTEM32>\sc.exe' config dmadmin start= DEMAND
'<SYSTEM32>\sc.exe' config dmserver start= AUTO
'<SYSTEM32>\sc.exe' config Dnscache start= AUTO
'<SYSTEM32>\sc.exe' config helpsvc start= DISABLED
'<SYSTEM32>\sc.exe' config lanmanserver start= DISABLED
'<SYSTEM32>\sc.exe' config lanmanworkstation start= AUTO
'<SYSTEM32>\sc.exe' config LmHosts start= DISABLED
'<SYSTEM32>\sc.exe' config HidServ start= DISABLED
'<SYSTEM32>\sc.exe' config HTTPFilter start= DEMAND
'<SYSTEM32>\sc.exe' config ImapiService start= DISABLED
'<SYSTEM32>\sc.exe' config AppMgmt start= DEMAND
'<SYSTEM32>\sc.exe' config AudioSrv start= AUTO
'<SYSTEM32>\sc.exe' config BITS start= DISABLED
'<SYSTEM32>\cmd.exe' /c %TEMP%\158781.bat
'<SYSTEM32>\sc.exe' config Alerter start= DISABLED
'<SYSTEM32>\sc.exe' config ALG start= DISABLED
'<SYSTEM32>\sc.exe' config Browser start= DISABLED
'<SYSTEM32>\sc.exe' config CryptSvc start= DEMAND
'<SYSTEM32>\sc.exe' config DcomLaunch start= AUTO
'<SYSTEM32>\sc.exe' config Dhcp start= DEMAND
'<SYSTEM32>\sc.exe' config CiSvc start= DISABLED
'<SYSTEM32>\sc.exe' config ClipSrv start= DISABLED
'<SYSTEM32>\sc.exe' config COMSysApp start= DEMAND
'<SYSTEM32>\sc.exe' config RasMan start= DEMAND
'<SYSTEM32>\sc.exe' config RDSessMgr start= DISABLED
'<SYSTEM32>\sc.exe' config remoteAccess start= DISABLED
'<SYSTEM32>\sc.exe' config PolicyAgent start= DEMAND
'<SYSTEM32>\sc.exe' config ProtectedStorage start= AUTO
'<SYSTEM32>\sc.exe' config RasAuto start= DEMAND
'<SYSTEM32>\sc.exe' config remoteRegistry start= DISABLED
'<SYSTEM32>\sc.exe' config SCardSvr start= DISABLED
'<SYSTEM32>\sc.exe' config Schedule start= AUTO
'<SYSTEM32>\sc.exe' config seclogon start= AUTO
'<SYSTEM32>\sc.exe' config RpcLocator start= DISABLED
'<SYSTEM32>\sc.exe' config RpcSs start= AUTO
'<SYSTEM32>\sc.exe' config SamSs start= AUTO
'<SYSTEM32>\sc.exe' config MSIServer start= DEMAND
'<SYSTEM32>\sc.exe' config NetDDE start= DISABLED
'<SYSTEM32>\sc.exe' config NetDDEdsdm start= DISABLED
'<SYSTEM32>\sc.exe' config Messenger start= DISABLED
'<SYSTEM32>\sc.exe' config mnmsrvc start= DISABLED
'<SYSTEM32>\sc.exe' config MSDTC start= DISABLED
'<SYSTEM32>\sc.exe' config Netlogon start= DISABLED
'<SYSTEM32>\sc.exe' config NtmsSvc start= DEMAND
'<SYSTEM32>\sc.exe' config ose start= DISABLED
'<SYSTEM32>\sc.exe' config PlugPlay start= AUTO
'<SYSTEM32>\sc.exe' config Netman start= DEMAND
'<SYSTEM32>\sc.exe' config Nla start= DISABLED
'<SYSTEM32>\sc.exe' config NtLmSsp start= DISABLED

Modifies file system :

Creates the following files:

%TEMP%\158781.bat

Deletes the following files:

<SYSTEM32>\CatRoot2\edb0000D.log
<SYSTEM32>\CatRoot2\edb0000E.log
%WINDIR%\SoftwareDistribution\DataStore\Logs\res2.log
<SYSTEM32>\CatRoot2\edb.log
<SYSTEM32>\CatRoot2\edb0000F.log
<SYSTEM32>\CatRoot2\edb00012.log
<SYSTEM32>\CatRoot2\edb00013.log
<SYSTEM32>\CatRoot2\edb00010.log
<SYSTEM32>\CatRoot2\edb00011.log
%WINDIR%\SoftwareDistribution\DataStore\Logs\res1.log
%WINDIR%\pchealth\helpctr\Logs\hcupdate.log
%WINDIR%\repair\setup.log
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.log
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
%WINDIR%\security\logs\backup.log
%WINDIR%\SoftwareDistribution\ReportingEvents.log
%WINDIR%\SoftwareDistribution\DataStore\Logs\edb.log
%WINDIR%\security\logs\SceRoot.log
%WINDIR%\security\logs\scesetup.log
<SYSTEM32>\wbem\Logs\wbemcore.log
<SYSTEM32>\wbem\Logs\wbemess.log
<SYSTEM32>\wbem\Logs\replog.log
<SYSTEM32>\wbem\Logs\setup.log
<SYSTEM32>\wbem\Logs\wbemprox.log
%WINDIR%\SoftwareDistribution\DataStore\Logs\edb.chk
<SYSTEM32>\CatRoot2\edb.chk
<SYSTEM32>\wbem\Logs\wmiadap.log
<SYSTEM32>\wbem\Logs\wmiprov.log
<SYSTEM32>\wbem\Logs\mofcomp.log
<SYSTEM32>\CatRoot2\edb00016.log
<SYSTEM32>\CatRoot2\edb00017.log
<SYSTEM32>\CatRoot2\edb00014.log
<SYSTEM32>\CatRoot2\edb00015.log
<SYSTEM32>\CatRoot2\res1.log
<SYSTEM32>\MsDtc\Trace\dtctrace.log
<SYSTEM32>\wbem\Logs\FrameWork.log
<SYSTEM32>\CatRoot2\res2.log
<SYSTEM32>\MsDtc\MSDTC.LOG
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
%WINDIR%\KB942288-v3.log
%WINDIR%\MedCtrOC.log
%WINDIR%\iis6.log
%WINDIR%\imsins.log
%WINDIR%\msgsocm.log
%WINDIR%\ntdtcsetup.log
%WINDIR%\ocgen.log
%WINDIR%\msmqinst.log
%WINDIR%\netfxocm.log
%WINDIR%\FaxSetup.log
%WINDIR%\SET8.tmp
<SYSTEM32>\CONFIG.TMP
%WINDIR%\SET3.tmp
%WINDIR%\SET4.tmp
%WINDIR%\0.log
%WINDIR%\comsetup.log
%WINDIR%\DtcInstall.log
%WINDIR%\cmsetacl.log
%WINDIR%\COM+.log
%WINDIR%\wiaservc.log
%WINDIR%\WindowsUpdate.log
%WINDIR%\updspapi.log
%WINDIR%\wiadebug.log
%WINDIR%\wmsetup.log
%WINDIR%\Debug\UserMode\userenv.log
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.log
%WINDIR%\Debug\blastcln.log
%WINDIR%\Debug\NetSetup.LOG
%WINDIR%\tsoc.log
%WINDIR%\sessmgr.setup.log
%WINDIR%\setupact.log
%WINDIR%\ocmsn.log
%WINDIR%\regopt.log
%WINDIR%\setupapi.log
%WINDIR%\Sti_Trace.log
%WINDIR%\tabletoc.log
%WINDIR%\setuperr.log
%WINDIR%\spupdsvc.log

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: '(null)'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial