Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Intel' = 'C:\Documento Importante.exe'
Infects the following executable system files:
- %WINDIR%\explorer.scf
Creates the following files on removable media:
- <Drive name for removable media>:\Documento Importante.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
Executes the following:
- <SYSTEM32>\cmd.exe /c ""C:\micro3.bat" "
- <SYSTEM32>\cmd.exe /c ""C:\micro2.bat" "
- <SYSTEM32>\cmd.exe /c ""C:\micro.bat" "
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
Modifies file system :
Creates the following files:
- C:\micro3.bat
- C:\Documento Importante.exe
- C:\micro.bat
- C:\micro2.bat
Sets the 'hidden' attribute to the following files:
- C:\micro3.bat
- C:\micro2.bat
- C:\micro.bat
Moves the following system files:
- from %WINDIR%\sleep.exe to %WINDIR%\sleep.jpg
- from %WINDIR%\Soap Bubbles.bmp to %WINDIR%\Soap Bubbles.jpg
- from %WINDIR%\setuplog.txt to %WINDIR%\setuplog.jpg
- from %WINDIR%\sfk.exe to %WINDIR%\sfk.jpg
- from %WINDIR%\spupdsvc.log to %WINDIR%\spupdsvc.jpg
- from %WINDIR%\tabletoc.log to %WINDIR%\tabletoc.jpg
- from %WINDIR%\TASKMAN.EXE to %WINDIR%\TASKMAN.jpg
- from %WINDIR%\Sti_Trace.log to %WINDIR%\Sti_Trace.jpg
- from %WINDIR%\system.ini to %WINDIR%\system.jpg
- from %WINDIR%\sessmgr.setup.log to %WINDIR%\sessmgr.setup.jpg
- from %WINDIR%\SET3.tmp to %WINDIR%\SET3.jpg
- from %WINDIR%\Santa Fe Stucco.bmp to %WINDIR%\Santa Fe Stucco.jpg
- from %WINDIR%\SchedLgU.Txt to %WINDIR%\SchedLgU.jpg
- from %WINDIR%\SET4.tmp to %WINDIR%\SET4.jpg
- from %WINDIR%\setupapi.log to %WINDIR%\setupapi.jpg
- from %WINDIR%\setuperr.log to %WINDIR%\setuperr.jpg
- from %WINDIR%\SET8.tmp to %WINDIR%\SET8.jpg
- from %WINDIR%\setupact.log to %WINDIR%\setupact.jpg
- from %WINDIR%\WindowsUpdate.log to %WINDIR%\WindowsUpdate.jpg
- from %WINDIR%\winhelp.exe to %WINDIR%\winhelp.jpg
- from %WINDIR%\wiaservc.log to %WINDIR%\wiaservc.jpg
- from %WINDIR%\win.ini to %WINDIR%\win.jpg
- from %WINDIR%\winhlp32.exe to %WINDIR%\winhlp32.jpg
- from %WINDIR%\Zapotec.bmp to %WINDIR%\Zapotec.jpg
- from %WINDIR%\_default.pif to %WINDIR%\_default.jpg
- from %WINDIR%\wmsetup.log to %WINDIR%\wmsetup.jpg
- from %WINDIR%\WMSysPr9.prx to %WINDIR%\WMSysPr9.jpg
- from %WINDIR%\twain_32.dll to %WINDIR%\twain_32.jpg
- from %WINDIR%\twunk_16.exe to %WINDIR%\twunk_16.jpg
- from %WINDIR%\tsoc.log to %WINDIR%\tsoc.jpg
- from %WINDIR%\twain.dll to %WINDIR%\twain.jpg
- from %WINDIR%\twunk_32.exe to %WINDIR%\twunk_32.jpg
- from %WINDIR%\vmmreg32.dll to %WINDIR%\vmmreg32.jpg
- from %WINDIR%\wiadebug.log to %WINDIR%\wiadebug.jpg
- from %WINDIR%\vb.ini to %WINDIR%\vb.jpg
- from %WINDIR%\vbaddin.ini to %WINDIR%\vbaddin.jpg
- from %WINDIR%\River Sumida.bmp to %WINDIR%\River Sumida.jpg
- from %WINDIR%\FeatherTexture.bmp to %WINDIR%\FeatherTexture.jpg
- from %WINDIR%\Gone Fishing.bmp to %WINDIR%\Gone Fishing.jpg
- from %WINDIR%\explorer.exe to %WINDIR%\explorer.jpg
- from %WINDIR%\FaxSetup.log to %WINDIR%\FaxSetup.jpg
- from %WINDIR%\Greenstone.bmp to %WINDIR%\Greenstone.jpg
- from %WINDIR%\imsins.BAK to %WINDIR%\imsins.jpg
- from %WINDIR%\KB893803v2.log to %WINDIR%\KB893803v2.jpg
- from %WINDIR%\hh.exe to %WINDIR%\hh.jpg
- from %WINDIR%\iis6.log to %WINDIR%\iis6.jpg
- from %WINDIR%\clock.avi to %WINDIR%\clock.jpg
- from %WINDIR%\cmsetacl.log to %WINDIR%\cmsetacl.jpg
- from %WINDIR%\0.log to %WINDIR%\0.jpg
- from %WINDIR%\Blue Lace 16.bmp to %WINDIR%\Blue Lace 16.jpg
- from %WINDIR%\Coffee Bean.bmp to %WINDIR%\Coffee Bean.jpg
- from %WINDIR%\desktop.ini to %WINDIR%\desktop.jpg
- from %WINDIR%\DtcInstall.log to %WINDIR%\DtcInstall.jpg
- from %WINDIR%\comsetup.log to %WINDIR%\comsetup.jpg
- from %WINDIR%\control.ini to %WINDIR%\control.jpg
- from %WINDIR%\OEWABLog.txt to %WINDIR%\OEWABLog.jpg
- from %WINDIR%\oobeact.log to %WINDIR%\oobeact.jpg
- from %WINDIR%\ocmsn.log to %WINDIR%\ocmsn.jpg
- from %WINDIR%\ODBCINST.INI to %WINDIR%\ODBCINST.jpg
- from %WINDIR%\Prairie Wind.bmp to %WINDIR%\Prairie Wind.jpg
- from %WINDIR%\regopt.log to %WINDIR%\regopt.jpg
- from %WINDIR%\Rhododendron.bmp to %WINDIR%\Rhododendron.jpg
- from %WINDIR%\regedit.exe to %WINDIR%\regedit.jpg
- from %WINDIR%\REGLOCS.OLD to %WINDIR%\REGLOCS.jpg
- from %WINDIR%\msgsocm.log to %WINDIR%\msgsocm.jpg
- from %WINDIR%\msmqinst.log to %WINDIR%\msmqinst.jpg
- from %WINDIR%\MedCtrOC.log to %WINDIR%\MedCtrOC.jpg
- from %WINDIR%\msdfmap.ini to %WINDIR%\msdfmap.jpg
- from %WINDIR%\netfxocm.log to %WINDIR%\netfxocm.jpg
- from %WINDIR%\ntdtcsetup.log to %WINDIR%\ntdtcsetup.jpg
- from %WINDIR%\ocgen.log to %WINDIR%\ocgen.jpg
- from %WINDIR%\NOTEPAD.EXE to %WINDIR%\NOTEPAD.jpg
- from %WINDIR%\nsreg.dat to %WINDIR%\nsreg.jpg
Moves itself:
- from <Full path to virus> to <Current directory>\<Virus name>.jpg
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
