Win32.HLLW.Autoruner1.34237

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '0x1.1039b0p-761ppdata\Microsoft\Windows\hRТ.scr'
[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '0x1.1039b0p-761ppdata\Microsoft\Windows\xТ.scr'
[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '0x1.1039b0p-761ppdata\Microsoft\Windows\eТ.scr'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'nvidgfx' = '%TEMP%\nvidgfx.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'nvidgfx' = '%APPDATA%\nvidgfx.exe'
[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '%APPDATA%\Microsoft\Windows\spacedots.scr'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Browser] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\SSDPSRV] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\upnphost] 'Start' = '00000002'

Creates the following files on removable media:

<Drive name for removable media>:\protect.bat
<Drive name for removable media>:\autorun.inf

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' = '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:winhttpsvc'

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Creates and executes the following:

%APPDATA%\errorreporter.exe

Executes the following:

<SYSTEM32>\reg.exe ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
<SYSTEM32>\reg.exe ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
<SYSTEM32>\reg.exe ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
<SYSTEM32>\reg.exe ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
<SYSTEM32>\attrib.exe +R +H "C:\autorun.inf"
<SYSTEM32>\reg.exe DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
<SYSTEM32>\reg.exe DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
<SYSTEM32>\reg.exe ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
<SYSTEM32>\net1.exe start browser
<SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
<SYSTEM32>\attrib.exe +S +R +H "%APPDATA%\nvidgfx.exe"
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
<SYSTEM32>\attrib.exe -S -R -H "%APPDATA%\nvidgfx.exe"
<SYSTEM32>\attrib.exe +R +H "E:\protect.bat"
<SYSTEM32>\attrib.exe +R +H "Z:protect.bat"
<SYSTEM32>\attrib.exe +R +H "C:\protect.bat"
<SYSTEM32>\attrib.exe +R +H "Z:\protect.bat"
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
<SYSTEM32>\attrib.exe +R +H "Z:\autorun.inf"
<SYSTEM32>\attrib.exe +R +H "Z:autorun.inf"
<SYSTEM32>\attrib.exe +R +H "E:\autorun.inf"
<SYSTEM32>\attrib.exe -R -H "Z:\protect.bat"
<SYSTEM32>\attrib.exe -R -H "Z:protect.bat"
<SYSTEM32>\attrib.exe -R -H "E:\protect.bat"
<SYSTEM32>\attrib.exe -R -H "C:\protect.bat"
<SYSTEM32>\net1.exe start SSDPSRV
<SYSTEM32>\reg.exe ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
<SYSTEM32>\reg.exe ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
<SYSTEM32>\reg.exe ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%APPDATA%\Microsoft\Windows\spacedots.scr" /f
<SYSTEM32>\reg.exe ADD "HKCR\.zip\ShellNew" /v "FileName" /t REG_SZ /d "%APPDATA%\newzip.dat" /f
<SYSTEM32>\reg.exe ADD "HKCR\.rar\ShellNew" /v "FileName" /t REG_SZ /d "%APPDATA%\newzip.dat" /f
<SYSTEM32>\cmd.exe /c ""%APPDATA%\plugininstall.bat" "
<SYSTEM32>\reg.exe ADD "HKCR\.zip\CompressedFolder\ShellNew" /v "FileName" /t REG_SZ /d "%APPDATA%\newzip.dat" /f
<SYSTEM32>\attrib.exe +R +H +S "%APPDATA%\Microsoft\Windows\spacedots.scr"
<SYSTEM32>\attrib.exe +R +H +S "%APPDATA%\nvidgfx.exe"
<SYSTEM32>\attrib.exe -R -H -S "%APPDATA%\nvidgfx.exe"
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
<SYSTEM32>\reg.exe ADD "HKCU\software\microsoft\windows\currentversion\run" /v "nvidgfx" /t REG_SZ /d "%APPDATA%\nvidgfx.exe" /f
<SYSTEM32>\attrib.exe -R -H -S "%APPDATA%\Microsoft\Windows\spacedots.scr"
<SYSTEM32>\attrib.exe +R +H +S "<SYSTEM32>\atlsyn.exe"
<SYSTEM32>\attrib.exe -R -H -S "<SYSTEM32>\atlsyn.exe"
<SYSTEM32>\sc.exe config SSDPSRV start= auto
<SYSTEM32>\sc.exe config upnphost start= auto
<SYSTEM32>\netsh.exe firewall set opmode DISABLE
<SYSTEM32>\sc.exe config browser start= auto
<SYSTEM32>\net1.exe start upnphost
<SYSTEM32>\net1.exe start seclogon
<SYSTEM32>\winlogon.exe
<SYSTEM32>\rundll32.exe
<SYSTEM32>\attrib.exe "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
<SYSTEM32>\notepad.exe
<SYSTEM32>\netsh.exe firewall add allowedprogram "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe" "winhttpsvc" ENABLE
<SYSTEM32>\attrib.exe "%WINDIR%\Microsoft.NET\Framework\v2.0.50727" +s +h
<SYSTEM32>\netsh.exe advfirewall firewall add rule name="Open Port 5220" profile=public dir=in action=allow protocol=TCP localport=5220
<SYSTEM32>\netsh.exe firewall add portopening TCP 5220 "Open Port 5220"
<SYSTEM32>\netsh.exe advfirewall firewall add rule name="winhttpsvc" profile=public dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe" enable=yes

Injects code into

the following system processes:

<SYSTEM32>\notepad.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Terminates or attempts to terminate

the following user processes:

firefox.exe

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = 'local'
[<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:5220'

Modifies file system :

Creates the following files:

C:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
%APPDATA%\plugininstall.bat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\lilliili[1].htm
C:\protect.bat
C:\autorun.inf
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mediaguide[1].asp
<SYSTEM32>\atlsyn.exe
%APPDATA%\nvidgfx.exe
%TEMP%\nvidgfx.exe
%APPDATA%\Microsoft\Windows\spacedots.scr
%APPDATA%\newzip.dat
%APPDATA%\errorreporter.exe
%APPDATA%\auth.dll

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\autorun.inf
%APPDATA%\newzip.dat
C:\autorun.inf
C:\protect.bat
<Drive name for removable media>:\protect.bat
<SYSTEM32>\atlsyn.exe
%APPDATA%\nvidgfx.exe
%APPDATA%\Microsoft\Windows\spacedots.scr
%APPDATA%\errorreporter.exe
%APPDATA%\auth.dll

Network activity:

Connects to:

'll####lllillll.in':5310
'll####lllillll.in':5320
'll##l.in':5390
'll####lllillll.in':5300
'll####lllillll.in':5370
'll####lllillll.in':5380
'll####lllillll.in':5330
'll####lllillll.in':5360
'll##l.in':5380
'll##l.in':5340
'll##l.in':5350
'll##l.in':5320
'll##l.in':5330
'localhost':1085
'wi####smedia.com':80
'll##l.in':5360
'll##l.in':5370
'll####lllillll.in':5390
'ii###li.info':5310
'ii###li.info':5320
'ii####liilli.info':5390
'ii###li.info':5300
'ii###li.info':5350
'ii###li.info':5360
'ii###li.info':5330
'ii###li.info':5340
'ii####liilli.info':5380
'ii####liilli.info':5320
'ii####liilli.info':5330
'ii####liilli.info':5300
'ii####liilli.info':5310
'ii####liilli.info':5360
'ii####liilli.info':5370
'ii####liilli.info':5340
'ii####liilli.info':5350
'il##il.in':5310
'il##il.in':5320
'ii##i.in':5390
'il##il.in':5300
'il##il.in':5350
'il##il.in':5360
'il##il.in':5330
'il##il.in':5340
'ii##i.in':5380
'ii##i.in':5320
'ii##i.in':5330
'ii##i.in':5300
'ii##i.in':5310
'ii##i.in':5360
'ii##i.in':5370
'ii##i.in':5340
'ii##i.in':5350
'il##il.in':5370
'li##li.in':5390
'localhost':5220
'li##li.in':5370
'li##li.in':5380
'll##l.in':5300
'll##l.in':5310
'74.##5.232.51':80
'li###ili.info':80
'li##li.in':5360
'li##li.in':5300
'li##li.in':5310
'il##il.in':5380
'il##il.in':5390
'li##li.in':5340
'li##li.in':5350
'li##li.in':5320
'li##li.in':5330

TCP:

HTTP GET requests:

wi####smedia.com/redir/mediaguide.asp?WM############################################
74.##5.232.51/

HTTP POST requests:

li###ili.info/

UDP:

DNS ASK wi####smedia.com
DNS ASK ll##l.in
DNS ASK ll####lllillll.in
DNS ASK ii###li.info
DNS ASK ii####liilli.info
DNS ASK il##il.in
DNS ASK ii##i.in
DNS ASK li##li.in
DNS ASK li###ili.info
DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'RegCool'
ClassName: '' WindowName: 'RegAlyzer'
ClassName: '' WindowName: 'Registry'
ClassName: '' WindowName: 'System Configuration'
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'WMPlayerApp' WindowName: ''
ClassName: '' WindowName: 'Registry Editor'
ClassName: 'ReBarWindow32' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'Indicator' WindowName: ''
ClassName: 'WMP9DeskBand' WindowName: 'WMP9DeskBand'
ClassName: '' WindowName: 'System Restore'
ClassName: 'Type32_Main_Window' WindowName: ''
ClassName: '' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information