Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DAEMON Tools-1033' = '"%ProgramFiles%\D-Tools\daemon.exe" -lang 1033'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\d347bus] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\d347bus] 'ImagePath' = 'system32\DRIVERS\d347bus.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\d347prt] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\d347prt] 'ImagePath' = 'System32\Drivers\d347prt.sys'
Malicious functions:
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding B199B232E6CFF8C23415A3C1C4241B52
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\RarSFX0\daemontools.msi" /passive /norestart
- '<SYSTEM32>\msiexec.exe' /V
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtQueryKey, handler: d347bus.sys
- NtOpenKey, handler: d347bus.sys
- NtSetSystemPowerState, handler: d347bus.sys
- NtQueryValueKey, handler: d347bus.sys
- NtEnumerateValueKey, handler: d347bus.sys
- NtCreateKey, handler: d347bus.sys
- NtClose, handler: d347bus.sys
- NtEnumerateKey, handler: d347bus.sys
- NtCreatePagingFile, handler: d347bus.sys
Modifies file system:
Creates the following files:
- %ProgramFiles%\D-Tools\Plugins\Images\bw5mount.dll
- <DRIVERS>\stormbus.sys
- %ProgramFiles%\D-Tools\Plugins\Images\nrgmount.dll
- %ProgramFiles%\D-Tools\pfctoc.dll
- %ProgramFiles%\D-Tools\Icons\tray2.ico
- %ProgramFiles%\D-Tools\Lang\1033.dll
- %ProgramFiles%\D-Tools\daemon.exe
- %ProgramFiles%\D-Tools\Plugins\Images\ccdmount.dll
- C:\Config.Msi\204bc.rbs
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %ProgramFiles%\D-Tools\Plugins\Images\mdsmount.dll
- %ProgramFiles%\D-Tools\Plugins\Images\pdimount.dll
- %WINDIR%\daemon.dll
- %ProgramFiles%\D-Tools\Icons\tray1.ico
- %TEMP%\inf7.tmp
- %TEMP%\inf6.tmp
- <DRIVERS>\d347prt.sys
- %WINDIR%\inf\oem3.inf
- %TEMP%\~DFE5FE.tmp
- %WINDIR%\inf\INFCACHE.0
- %WINDIR%\inf\oem3.PNF
- %ALLUSERSPROFILE%\Desktop\DAEMON Tools.lnk
- <DRIVERS>\stormprt.sys
- %ProgramFiles%\D-Tools\Help\1033.chm
- %WINDIR%\Installer\204bd.msi
- <DRIVERS>\d347bus.sys
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}\_daemoncp.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\204b9.msi
- %TEMP%\RarSFX0\daemontools.msi
- %WINDIR%\Installer\MSI2.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %TEMP%\~DF9BB0.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %WINDIR%\Installer\MSI3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %WINDIR%\Installer\204bb.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
Deletes the following files:
- C:\Config.Msi\204bc.rbs
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI5.tmp
- %TEMP%\RarSFX0\daemontools.msi
- %WINDIR%\Installer\204bb.ipi
- %WINDIR%\Installer\204b9.msi
- <DRIVERS>\stormbus.sys
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI1.tmp
- %TEMP%\inf7.tmp
- %TEMP%\inf6.tmp
- <DRIVERS>\stormprt.sys
Moves the following system files:
- from %WINDIR%\inf\INFCACHE.2 to %WINDIR%\inf\OLDCACHE.000
- from %WINDIR%\inf\INFCACHE.1 to %WINDIR%\inf\INFCACHE.2
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
