Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MsnMsgr' = '"%PROGRAM_FILES%\Windows Live\Messenger\MsnMsgr.Exe" /background'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.siren' = 'sirenacm.dll'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\msnim] 'CLSID' = '{828030A1-22C1-4009-854F-8E305202313F}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\livecall] 'CLSID' = '{828030A1-22C1-4009-854F-8E305202313F}'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Windows Live\Messenger\livecall.exe' = '%PROGRAM_FILES%\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Windows Live\Messenger\livecall.exe' = '%PROGRAM_FILES%\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Windows Live\Messenger\msnmsgr.exe' = '%PROGRAM_FILES%\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Windows Live\Messenger\msnmsgr.exe' = '%PROGRAM_FILES%\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger'
Creates and executes the following:
- '%TEMP%\RarSFX0\WLMEdit.exe'
- '%PROGRAM_FILES%\Windows Live\Messenger\Device Manager\dpinst.exe' /q /f /sa
- '%TEMP%\RarSFX0\msiexec.exe' /i Msn.msi /quiet /norestart
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding 27B71C34912715D9DC12DE7634267D54
- '<SYSTEM32>\msiexec.exe' -Embedding 5EFCAAA4210E3332CFC003F815571B24 M Global\MSI0000
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\msn.cmd" "
- '<SYSTEM32>\msiexec.exe' /V
Searches for registry branches where third party applications store passwords:
- [<HKLM>\Software\Microsoft\MSNMessenger]
- [<HKCU>\SOFTWARE\Microsoft\MSNMessenger]
- [<HKCU>\Software\Microsoft\MessengerService]
- [<HKLM>\Software\Microsoft\MessengerService]
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Windows Live\Messenger\lmcdata.dll
- %PROGRAM_FILES%\Windows Live\Messenger\contact.dll
- <SYSTEM32>\sirenacm.dll
- %PROGRAM_FILES%\Windows Live\Messenger\abssm.dll
- %PROGRAM_FILES%\Windows Live\Messenger\lcapi.dll
- %PROGRAM_FILES%\Windows Live\Messenger\lcres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\RTMPLTFM.dll
- %PROGRAM_FILES%\Windows Live\Messenger\usnsvcps.dll
- %PROGRAM_FILES%\Windows Live\Messenger\dfsr.dll
- %PROGRAM_FILES%\Windows Live\Messenger\fsshext.8.5.1288.0816.dll
- %PROGRAM_FILES%\Windows Live\Messenger\usnsvc.exe
- %PROGRAM_FILES%\Windows Live\Messenger\wmp8stub.dll
- %PROGRAM_FILES%\Windows Live\Messenger\custsat.dll
- %PROGRAM_FILES%\Windows Live\Messenger\psmsong.8.5.1288.0816.dll
- %PROGRAM_FILES%\Windows Live\Messenger\msgrapp.8.5.1288.0816.dll
- %PROGRAM_FILES%\Windows Live\Messenger\msncore.dll
- %PROGRAM_FILES%\Windows Live\Messenger\contactsUX.dll
- %PROGRAM_FILES%\Windows Live\Messenger\msgswcam.dll
- %PROGRAM_FILES%\Windows Live\Messenger\msnmsgr.exe
- %PROGRAM_FILES%\Windows Live\Messenger\type.wma
- %PROGRAM_FILES%\Windows Live\Messenger\vimdone.wma
- %PROGRAM_FILES%\Windows Live\Messenger\license.rtf
- %PROGRAM_FILES%\Windows Live\Messenger\msgrvsta.thm
- %PROGRAM_FILES%\Windows Live\Messenger\wmv9vcm.dll
- %PROGRAM_FILES%\Windows Live\Messenger\wmaecdmort.dll
- %PROGRAM_FILES%\Windows Live\Messenger\highcont.thm
- %PROGRAM_FILES%\Windows Live\Messenger\msgsc.8.5.1288.0816.dll
- %PROGRAM_FILES%\Windows Live\Messenger\msgsres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\msgslang.8.5.1288.0816.dll
- %PROGRAM_FILES%\Windows Live\Messenger\livecall.exe
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- <SYSTEM32>\DRVSTORE\wlphonecv_B88DA7978559975500983DADC0107CF3AA89C14C\WLPhoneCV.cat
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D
- <SYSTEM32>\DRVSTORE\wlphonecv_B88DA7978559975500983DADC0107CF3AA89C14C\wlphonecv.inf
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSI11.tmp
- %WINDIR%\Installer\MSI12.tmp
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\{6560D90C-5223-49A3-B78C-A48C31EAEC56}\MsblIco.Exe
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\904590238400AD963F77FAAAADC9BAB5
- %PROGRAM_FILES%\Windows Live\Messenger\htc.dll
- %PROGRAM_FILES%\Windows Live\Messenger\MessengerClient.dll
- %WINDIR%\Installer\$PatchCache$\Managed\C09D065632253A947BC84AC813AECE65\8.5.1288\dwtrig20.exe.D0DF3458_A845_11D3_8D0A_0050046416B9
- %PROGRAM_FILES%\Windows Live\Messenger\softphoneps.dll
- %PROGRAM_FILES%\Windows Live\Messenger\pcsexeps.dll
- %PROGRAM_FILES%\Windows Live\Messenger\softphoneres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\softphone.dll
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\DPINST.LOG
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\904590238400AD963F77FAAAADC9BAB5
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\$PatchCache$\Managed\C09D065632253A947BC84AC813AECE65\8.5.1288\dw20.exe_0001.D0DF3458_A845_11D3_8D0A_0050046416B9
- %WINDIR%\Installer\$PatchCache$\Managed\C09D065632253A947BC84AC813AECE65\8.5.1288\dwdcw20.dll.D0DF3458_A845_11D3_8D0A_0050046416B9
- %ALLUSERSPROFILE%\Start Menu\Programs\Windows Live\Windows Live Messenger .lnk
- %PROGRAM_FILES%\Windows Live\Messenger\phone.wma
- %PROGRAM_FILES%\Windows Live\Messenger\msvsConfig2.xml
- %PROGRAM_FILES%\Windows Live\Messenger\msvsui.dll
- %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll
- %PROGRAM_FILES%\Windows Live\Messenger\msvs.exe
- %WINDIR%\Installer\MSI7.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll
- %PROGRAM_FILES%\Windows Live\Messenger\msidcrl40.dll
- %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.163.policy
- %WINDIR%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.163.cat
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\18\msndevmanres.dll
- %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb.manifest
- %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll
- %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb.cat
- %WINDIR%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll
- %WINDIR%\Installer\MSI6.tmp
- %TEMP%\RarSFX0\MSINET.OCX
- %WINDIR%\Installer\1f1ae.msi
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\A44F4E7CB3133FF765C39A53AD8FCFDD
- %TEMP%\RarSFX0\msiexec.exe
- %TEMP%\RarSFX0\msn.cmd
- %TEMP%\RarSFX0\msn.msi
- %TEMP%\RarSFX0\WLMEdit.exe
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI4.tmp
- C:\Config.Msi\1f1b1.rbs
- %WINDIR%\Installer\MSI2.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\A44F4E7CB3133FF765C39A53AD8FCFDD
- %WINDIR%\Installer\MSI1.tmp
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\25\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\6\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\31\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\22\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\29\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\WLPhoneCV.cat
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\9\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\16\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\nudge.wma
- %PROGRAM_FILES%\Windows Live\Messenger\online.wma
- %PROGRAM_FILES%\Windows Live\Messenger\outgoing.wma
- %PROGRAM_FILES%\Windows Live\Messenger\newemail.wma
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\19\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\ErrorResponse.xml
- %PROGRAM_FILES%\Windows Live\Messenger\newalert.wma
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\WLPhoneCV.inf
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\dpinst.exe
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\dpinst64.exe
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\custom.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\17\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\4\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\7\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\1046\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\12\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\11\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\20\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\10\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\1028\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\Loc\8\msndevmanres.dll
- %PROGRAM_FILES%\Windows Live\Messenger\Device Manager\msgrdvmn.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Deletes the following files:
- C:\Config.Msi\1f1b1.rbs
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\1f1ae.msi
- %WINDIR%\Installer\1f1b0.ipi
- %WINDIR%\Installer\MSI11.tmp
- %WINDIR%\Installer\MSI12.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI8.tmp
Network activity:
Connects to:
- 'localhost':1048
- 'bb#.let.tw':80
- 'wp#d':80
- '20#.#6.232.182':80
TCP:
HTTP GET requests:
- 20#.#6.232.182/pki/crl/products/tspca.crl
- bb#.let.tw/Msn/WLMEdit.html
- 20#.#6.232.182/pki/crl/products/WHQLPCA.crl
- wp#d/wpad.dat
- 20#.#6.232.182/pki/crl/products/CodeSignPCA2.crl
UDP:
- DNS ASK bb#.let.tw
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
