Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '▒ъ╫╝╦╤╦ў'
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=2'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] '360safe' = '"%WINDIR%\SYSTEM\twunk_32.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce] '360safetray' = '"<SYSTEM32>\winxml.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'internat' = '"<SYSTEM32>\WinUpdate.exe"'
Malicious functions:
Executes the following:
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Icon" /d "<SYSTEM32>\shell32.dll,15" /f
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\shell32.dll,15" /f
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "▒ъ╫╝╦╤╦ў" /f
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\shell32.dll,15" /f
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "▒ъ╫╝╦╤╦ў" /f
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "▒ъ╫╝╦╤╦ў" /f
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.bi#o.cn/js/re.asp?i=#" /f
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
- <SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "▒ъ╫╝╦╤╦ў" /f
- <SYSTEM32>\at.exe 13:15 /every:T,TH,f,Sa,Su %WINDIR%\winu.exe
- <SYSTEM32>\at.exe 20:54 %WINDIR%\pat32.exe
- <SYSTEM32>\at.exe /delete /yes
- <SYSTEM32>\cmd.exe /c """%TEMP%\office2003.bat"""
- <SYSTEM32>\ping.exe -n 1 biso.cn
- <SYSTEM32>\reg.exe delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /va /f
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google ╦╤╦ў" /v "" /d "http://www.bi#o.cn/js/menu.asp?me#########" /f
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\│г╙├╚э╝■" /v "" /d "http://www.bi#o.cn/js/menu.asp?me#######" /f
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce /v 360safe /d """"%WINDIR%\SYSTEM\twunk_32.exe"""" /f
- <SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce /v 360safetray /d """"<SYSTEM32>\winxml.exe"""" /f
- <SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce /v internat /d """"<SYSTEM32>\WinUpdate.exe"""" /f
Modifies file system :
Creates the following files:
- <Current directory>\a.txt
- %HOMEPATH%\Favorites\Google▒ъ╫╝╦╤╦ў.url
- %TEMP%\office2003.bat
- %TEMP%\exe1.tmp
Deletes the following files:
- %TEMP%\office2003.bat
- %TEMP%\exe1.tmp
- <Current directory>\a.txt
Network activity:
UDP:
- DNS ASK bi#o.cn
