Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Client Server Runtime Subsystem Server 7.20' = '<SYSTEM32>\config\csrss.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Session Manager Subsystem Server 3.91' = '<SYSTEM32>\config\smss.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\Folder.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions:
Creates and executes the following:
- <SYSTEM32>\config\csrss.exe
- <SYSTEM32>\config\smss.exe
- %WINDIR%\Temp\hive.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\config\csrss.exe
- %WINDIR%\Help\OEM\fr-Fr\CRNURN11101150957PM.ini
- C:\Sm9ssE2039.dat
- %WINDIR%\Temp\hive.exe
Deletes the following files:
- <SYSTEM32>\config\smss.exe
- %TEMP%\~DFA6BF.tmp
- C:\Sm9ssE2039.dat
- %TEMP%\~DF9FE6.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Connections Tray'
- ClassName: '' WindowName: 'Tiny H-Pot v1.6'
- ClassName: '' WindowName: '<Auxiliary name>'
- ClassName: '' WindowName: 'Show details for each &battery.'
- ClassName: '' WindowName: 'Power Meter'
- ClassName: '' WindowName: 'Power status'
- ClassName: '' WindowName: '&Always show icon on the taskbar.'
- ClassName: '' WindowName: 'Main'
- ClassName: '' WindowName: '0 Sm9ssE2039 E smss.exe 893'
- ClassName: '' WindowName: '0 Sm9ssE2039 E csrss.exe 893'
- ClassName: '' WindowName: 'Life'
- ClassName: '' WindowName: '<SYSTEM32>\cscript.exe'
- ClassName: '' WindowName: '<Auxiliary name> - build Mar 22 2011'
- ClassName: '' WindowName: 'CicMarshalWndAMK'
- ClassName: '' WindowName: 'OleMainThreadWndName'
- ClassName: '' WindowName: 'OLEChannelWnd'
- ClassName: '' WindowName: 'Start'
- ClassName: '' WindowName: 'CiceroUIWndFrame'
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'TF_FloatingLangBar_WndTitle'
- ClassName: '' WindowName: 'CicMarshalWndICG'
- ClassName: '' WindowName: 'CicMarshalWndMHG'
- ClassName: '' WindowName: 'CicMarshalWndIJF'
- ClassName: '' WindowName: 'MS_WebcheckMonitor'
- ClassName: '' WindowName: 'FolderView'
- ClassName: '' WindowName: 'Notification Area'
- ClassName: '' WindowName: 'Running Applications'
- ClassName: '' WindowName: 'Program Manager'
