Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HKCU' = ''
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}] 'StubPath' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,%PROGRAM_FILES%\ebaurodr\mhrhcrji.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '18.exe' = '%APPDATA%Microsoft\System\Services\18.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18.exe' = '%APPDATA%Microsoft\System\Services\18.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'HKLM' = ''
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe
Creates the following files on removable media:
- <Drive name for removable media>:\RECYCLER\S-4-8-22-0407151415-0885180045-668684408-5603\DZFhdboo.cpl
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\RECYCLER\S-4-8-22-0407151415-0885180045-668684408-5603\fQDMJnKL.exe
Malicious functions:
Creates and executes the following:
- '%APPDATA%\InstallDir\Server.exe'
- '%ALLUSERSPROFILE%\Application Data\msconfigmgr.exe'
- '%ALLUSERSPROFILE%\Application Data\msconfig.exe'
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\Windows\((Mutex)).dat
- %TEMP%\~TM2.tmp
- %PROGRAM_FILES%\Internet Explorer\dmlconf.dat
- %PROGRAM_FILES%\ebaurodr\mhrhcrji.exe
- %TEMP%\~TM1.tmp
- %APPDATA%Microsoft\System\Services\18.exe
- %ALLUSERSPROFILE%\Application Data\msconfig.exe
- %ALLUSERSPROFILE%\Application Data\msconfigmgr.exe
- %APPDATA%\InstallDir\Server.exe
- %APPDATA%\Microsoft\Windows\((Mutex)).cfg
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe
- %APPDATA%\Microsoft\Windows\((Mutex)).dat
- %APPDATA%\Microsoft\Windows\((Mutex)).cfg
Deletes the following files:
- %APPDATA%\Microsoft\Windows\((Mutex)).cfg
- %TEMP%\~TM2.tmp
- %TEMP%\~TM1.tmp
Network activity:
Connects to:
- 'localhost':1093
- 'localhost':1092
- 'localhost':1095
- 'localhost':1094
- 'localhost':1080
- 'localhost':1067
- 'localhost':1066
- 'localhost':1079
- 'localhost':1068
- 'localhost':1097
- 'localhost':1133
- 'localhost':1132
- 'localhost':1135
- 'localhost':1134
- 'localhost':1131
- 'localhost':1099
- 'localhost':1098
- 'localhost':1130
- 'localhost':1127
- 'localhost':1045
- 'localhost':1044
- 'localhost':1047
- 'st###oliks.com':443
- 'localhost':1041
- 'localhost':1038
- 'localhost':1037
- 'localhost':1040
- 'localhost':1039
- '74.##5.232.51':80
- 'localhost':1061
- 'localhost':1059
- 'localhost':1065
- 'localhost':1064
- 'localhost':1058
- 'localhost':81
- 'localhost':1049
- 'localhost':1057
- 'localhost':1055
UDP:
- DNS ASK pr###liks.com
- DNS ASK google.com
- DNS ASK st###oliks.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
