Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\CmdSYSTEM] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\CmdSYSTEM] 'ImagePath' = 'cmd /c start <SYSTEM32>\Microsoft\winlogon.exe <SYSTEM32>\mswmdm.vbe 1'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "<SYSTEM32>\mswmdm.vbe"
Executes the following:
- '<SYSTEM32>\cmd.exe' /c start <SYSTEM32>\Microsoft\winlogon.exe <SYSTEM32>\mswmdm.vbe 1
- '<SYSTEM32>\net1.exe' start CmdSYSTEM
- '<SYSTEM32>\sc.exe' config CmdSYSTEM start= auto
- '<SYSTEM32>\svchosl.exe'
- '<SYSTEM32>\Microsoft\winlogon.exe' <SYSTEM32>\mswmdm.vbe 1
- '<SYSTEM32>\sc.exe' create CmdSYSTEM type= own type= interact binPath= "cmd /c start <SYSTEM32>\Microsoft\winlogon.exe <SYSTEM32>\mswmdm.vbe 1"
- '<SYSTEM32>\cmd.exe' /c sc create CmdSYSTEM type= own type= interact binPath= "cmd /c start <SYSTEM32>\Microsoft\winlogon.exe <SYSTEM32>\mswmdm.vbe 1"
- '<SYSTEM32>\regsvr32.exe' /s XHTTP.dll
- '<SYSTEM32>\cmd.exe' /c net start CmdSYSTEM
- '<SYSTEM32>\net.exe' start CmdSYSTEM
- '<SYSTEM32>\cmd.exe' /c sc config CmdSYSTEM start= auto
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
- <SYSTEM32>\XHTTP.dll
- <SYSTEM32>\Microsoft\winlogon.exe
- <SYSTEM32>\svchosl.exe
- <SYSTEM32>\lps.ini
- <SYSTEM32>\mswmdm.vbe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
