Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '<SYSTEM32>\SVCH0ST.EXE'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System' = '<SYSTEM32>\SVCH0ST.EXE'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Creates and executes the following:
- '<SYSTEM32>\SVCH0ST.EXE'
Executes the following:
- '<SYSTEM32>\net1.exe' start
- '<SYSTEM32>\net1.exe' user
- '<SYSTEM32>\net1.exe' share
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\netstat.exe' -ano
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\Microsoft\help\ntdetect.bat
- %ALLUSERSPROFILE%\Application Data\Microsoft\help\ntinfo
- %ALLUSERSPROFILE%\Application Data\Microsoft\help\ld~1.tmp
- <SYSTEM32>\SVCH0ST.EXE
- %ALLUSERSPROFILE%\Application Data\Microsoft\help\map.txt
Deletes the following files:
- %ALLUSERSPROFILE%\Application Data\Microsoft\help\ntdetect.bat
- %ALLUSERSPROFILE%\Application Data\Microsoft\help\map.txt
Moves the following files:
- from %ALLUSERSPROFILE%\Application Data\Microsoft\help\ld~1.tmp to %ALLUSERSPROFILE%\Application Data\Microsoft\help\map.log.sks
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
