Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Pcmcia] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\Modem] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\Spooler] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\netmoni] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Cdrom] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\Flpydisk] 'Start' = '00000001'
Malicious functions:
Executes the following:
- <SYSTEM32>\rundll32.exe "%ALLUSERSPROFILE%\application data\jgsoft\dllproject.dll" RunTest
- <SYSTEM32>\wbem\wmiadap.exe /R /T
- <SYSTEM32>\svchost.exe -k winmon
- <SYSTEM32>\svchost.exe -k winmon2
Modifies file system :
Creates the following files:
- <SYSTEM32>\wbem\Performance\WmiApRpl_new.ini
- <SYSTEM32>\QMCture\winfile.qmfc
- <SYSTEM32>\QMCture\winfile.qmfc-journal
- %WINDIR%\Temp\_temp_dir.tmp
- <SYSTEM32>\QMCture\mainwinfile.qmfc
- <SYSTEM32>\QMCture\mainwinfile.qmfc-journal
- C:\cmj.txt
- %ALLUSERSPROFILE%\Application Data\JGSoft\dllproject.dll
- %ALLUSERSPROFILE%\Application Data\JGSoft\dllproject.dll.dat
- %ALLUSERSPROFILE%\Application Data\JGSoft\cmjfilem.sys
- %ALLUSERSPROFILE%\Application Data\JGSoft\cmjNetDriver.sys
- %ALLUSERSPROFILE%\Application Data\JGSoft\viewplug2004.dll
Deletes the following files:
- <SYSTEM32>\QMCture\winfile.qmfc-journal
- <SYSTEM32>\QMCture\mainwinfile.qmfc-journal
- %WINDIR%\Temp\_temp_dir.tmp
- %ALLUSERSPROFILE%\Application Data\JGSoft\dllproject.dll.dat
- C:\cmj.txt
- %ALLUSERSPROFILE%\Application Data\JGSoft\dllproject.dll
Network activity:
Connects to:
- 'any':444
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'WINHOST_SERVICE_MUTEX_D'
- ClassName: '' WindowName: 'WINHOST_SERVICE_MUTEX_E'
