Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, wscript.exe //B "%TEMP%\System\smss-DoOoMs.vbs"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,wscript.exe //B "%TEMP%\System\smss-DoOoMs.vbs"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype' = '"%ProgramFiles% (x86)\Skype\Phone\Skype.exe" /minimized /regrun, wscript.exe //B "%TEMP%\\Media Player\smss-DoOoMp.lnk"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype' = '"%ProgramFiles%\Skype\Phone\Skype.exe" /minimized /regrun, wscript.exe //B "%TEMP%\\Media Player\smss-DoOoMp.lnk"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss-DoOoMs' = '"%TEMP%\Media Player\smss-DoOoMp.lnk"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss-DoOoM' = '"%TEMP%\Media Player\smss-DoOoM.lnk"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss-DoOoM' = '"%TEMP%\Media Player\smss-DoOoM.lnk"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss-DoOoMs' = '"%TEMP%\Media Player\smss-DoOoMp.lnk"'
Creates or modifies the following files
- %HOMEPATH%\start menu\programs\startup\smss-dooom.lnk
- %HOMEPATH%\start menu\programs\startup\smss-doooms.lnk
Creates the following files on removable media
- <Drive name for removable media>:\correct.avi.lnk
- <Drive name for removable media>:\movies.lnk
- <Drive name for removable media>:\pictures.lnk
- <Drive name for removable media>:\videos.lnk
- <Drive name for removable media>:\tcm851ax32.exe.lnk
- <Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe.lnk
- <Drive name for removable media>:\notepad.exe.lnk
- <Drive name for removable media>:\utorrent.exe.lnk
- <Drive name for removable media>:\holycrosschurchinstructions.docx.lnk
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.docx.lnk
- <Drive name for removable media>:\glidescope_review_rev_010.docx.lnk
- <Drive name for removable media>:\games.lnk
- <Drive name for removable media>:\sdszfo.docx.lnk
- <Drive name for removable media>:\fi51.doc.lnk
- <Drive name for removable media>:\applicantform_en.doc.lnk
- <Drive name for removable media>:\contoso.cer.lnk
- <Drive name for removable media>:\testee.cer.lnk
- <Drive name for removable media>:\contosoroot.cer.lnk
- <Drive name for removable media>:\contoso_1.cer.lnk
- <Drive name for removable media>:\dashborder_96.bmp.lnk
- <Drive name for removable media>:\split.avi.lnk
- <Drive name for removable media>:\000814251_video_01.avi.lnk
- <Drive name for removable media>:\delete.avi.lnk
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.lnk
- <Drive name for removable media>:\dcim.lnk
Modifies file system
Creates the following files
- %TEMP%\media player\smss-dooomp.lnk
- %TEMP%\smss-dooom-privacy\smss-dooom.vbe
- %TEMP%\system\smss-doooms.vbs
- %TEMP%\smss-dooom-service\smss-doooms.vbe
- %TEMP%\media player\smss-dooom.lnk
Network activity
UDP
- DNS ASK ja#####017.myq-see.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\schtasks.exe' /create /sc ONLOGON /RL HIGHEST /tn smss-DoOoM.vbe /tr "%TEMP%\System\smss-DoOoMs.vbs"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /sc ONLOGON /RL HIGHEST /tn smss-DoOoM.vbe /tr "%TEMP%\System\smss-DoOoMs.vbs"
