Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Creates and executes the following:
- 'C:\ComboFix\grep.cfexe' -Fixvf path02 path01
- 'C:\ComboFix\sed.cfexe' ":a; $!N; s/\n/\x3b/g; ta" path03
- 'C:\ComboFix\sed.cfexe' "/.*\t/!d; s///; s/\x3b/\n/g " path00
- 'C:\ComboFix\swreg.cfexe' add "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve /d "<Full path to virus>"
- 'C:\ComboFix\swreg.cfexe' query "hklm\system\currentcontrolset\control\session manager\environment" /v path
- 'C:\ComboFix\swreg.cfexe' query "hklm\system\currentcontrolset\control\session manager\environment" /v comspec
- 'C:\ComboFix\grep.cfexe' -q "currentversion.* 6.0" osVer00
- 'C:\ComboFix\swreg.cfexe' query hklm\system\currentcontrolset\enum\root\system
- 'C:\ComboFix\grep.cfexe' -q "Windows 2000"
- 'C:\ComboFix\grep.cfexe' -iq "REG_EXPAND_SZ %systemroot%\\system32\\cmd.exe$" comspec00
- 'C:\ComboFix\grep.cfexe' -q "Windows XP"
- 'C:\ComboFix\nircmd.cfexe' killprocess trayicon.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess VFind.cfexe
- 'C:\ComboFix\nircmd.cfexe' killprocess flashy.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess OSO.EXE
- 'C:\ComboFix\nircmd.cfexe' killprocess verclsid.dat
- 'C:\ComboFix\nircmd.cfexe' killprocess grep.cfexe
- 'C:\ComboFix\nircmd.cfexe' killprocess ad-watch.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess Ad-Watch2007.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess teatimer.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess sed.cfexe
- 'C:\ComboFix\nircmd.cfexe' killprocess ntvdm.exe
- 'C:\ComboFix\nircmd.com' -r -e "/datetest_/I!d; s/.{26}//;s/ .*//"
- 'C:\ComboFix\swreg.cfexe' /pid=2856
- 'C:\ComboFix\nircmd.com' -lrtf "datetest_"
- 'C:\ComboFix\nircmd.cfexe' sysrefresh intl
- 'C:\ComboFix\nircmd.cfexe' service start winmgmt
- 'C:\ComboFix\nircmd.cfexe' /pid=2880
- 'C:\ComboFix\vfind.cfexe' -rtf -d+2014-03-21 C:\ComboFix\ComboFix.bat
- 'C:\ComboFix\nircmd.cfexe' Infobox "Current date is 2014-03-31.~n~nThis copy of ComboFix has expired.~nPlease download an updated copy" "Expired - 08-01-23.1"
- 'C:\ComboFix\swreg.cfexe' /pid=2976
- 'C:\ComboFix\swreg.cfexe' /S /D /c" echo.08-01-23.1 "
- 'C:\ComboFix\grep.cfexe' -sq [0-9]
- 'C:\ComboFix\nircmd.cfexe' cmdwait 5000 killprocess regt.cfexe
- 'C:\ComboFix\regt.cfexe' /s creg.dat
- 'C:\ComboFix\swreg.cfexe' delete "hkcu\software\microsoft\windows\currentversion\policies\system" /v "disableregistrytools"
- 'C:\ComboFix\swreg.cfexe' query hkcr\clsid\{9f143c3a-1457-6cca-03a7-7aa23b61e40f}\inprocserver32 /ve
- 'C:\ComboFix\sed.cfexe' "/:\\/!d; s/.*\t//"
- '%WINDIR%\Nircmd.exe' killprocess Nircmd.cfexe
- 'C:\ComboFix\swreg.cfexe' copy "hku\.default\control panel\international" "hku\.default\control panel\international_combofixbackup" /s
- 'C:\ComboFix\swreg.cfexe' import region.dat
- 'C:\ComboFix\swreg.cfexe' copy "hkcu\control panel\international" "hkcu\control panel\international_combofixbackup" /s
- 'C:\ComboFix\nircmd.cfexe' service manual wmi
- 'C:\ComboFix\swreg.cfexe' query "hkcu\control panel\international_combofixbackup"
- 'C:\ComboFix\grep.cfexe' -vi "detoured.dll" ForeignA.dat
- 'C:\ComboFix\grep.cfexe' -Fsq \ Foreign.dat
- 'C:\ComboFix\nircmd.com' killprocess Nircmd.cfexe
- 'C:\ComboFix\ListDlls.cfexe' cmd.exe
- 'C:\ComboFix\sed.cfexe' -r "/.* {14}/!d;s///"
- 'C:\ComboFix\nircmd.cfexe' service stop catchme
- 'C:\ComboFix\nircmd.cfexe' abortshutdown
- 'C:\ComboFix\swreg.cfexe' query "hklm\system\currentcontrolset\control\nls\language" /v installlanguage
- 'C:\ComboFix\grep.cfexe' -Fisq /u
- 'C:\ComboFix\kmd.exe' /d /c Echo.%debug_log%
- 'C:\ComboFix\grep.cfexe' -Fisq "/killall"
- 'C:\ComboFix\swreg.cfexe' import exe.reg
- 'C:\ComboFix\nircmd.cfexe' win close ititle "ComboFix"
- 'C:\ComboFix\swxcacls.cfexe' "<SYSTEM32>\cmd.exe" /p /ga:f /gs:f /gp:x /gu:x /q
- 'C:\ComboFix\nircmd.com' execmd swreg.cfexe import exe.reg
- 'C:\ComboFix\nircmd.com' exec hide swxcacls.cfexe "<SYSTEM32>\cmd.exe" /p /ga:f /gs:f /gp:x /gu:x /q
- 'C:\ComboFix\swreg.cfexe' query "hklm\software\microsoft\windows nt\currentversion" /v currentversion
- 'C:\ComboFix\nircmd.cfexe' cmdwait 2000 killprocess ListDLLs.cfexe
- 'C:\ComboFix\nircmd.cfexe' cmdwait 2000 killprocess sed.cfexe
- 'C:\ComboFix\grep.cfexe' -Fqi ".CFEXE;"
- 'C:\ComboFix\grep.cfexe' -sq "currentversion.* 6.0" osVer00
- 'C:\ComboFix\grep.cfexe' -Fiq " /Ex-CF "
- 'C:\ComboFix\nircmd.cfexe' killprocess spool.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess thguard.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess cftmon.exe
- 'C:\ComboFix\grep.cfexe' -Evxq "437|708|720|737|775|85[0257]|86[01234569]|874|93[26]|949|950|1258"
- 'C:\ComboFix\grep.cfexe' -Fiq "/killall"
- 'C:\ComboFix\nircmd.cfexe' killprocess bryato.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess logo1_.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess rundl132.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess severe.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess conime.exe
- 'C:\ComboFix\nircmd.cfexe' killprocess fubcwj.exe
- 'C:\ComboFix\grep.cfexe' -q "13$"
- 'C:\ComboFix\grep.cfexe' -q "07$"
- 'C:\ComboFix\grep.cfexe' -q "0C$"
- 'C:\ComboFix\sed.cfexe' "/.*\t/!d; s///"
- 'C:\ComboFix\mtee.cfexe' NlsLang
- 'C:\ComboFix\grep.cfexe' -q "0B$"
- 'C:\ComboFix\grep.cfexe' -q "0A$"
- 'C:\ComboFix\swreg.cfexe' query "hklm\system\currentcontrolset\control\nls\codepage" /v oemcp
- 'C:\ComboFix\grep.cfexe' -q "10$"
- 'C:\ComboFix\grep.cfexe' -q "16$"
- 'C:\ComboFix\grep.cfexe' -q "04$"
Executes the following:
- '<SYSTEM32>\findstr.exe' -MIF:msnetax00 update_load
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
Terminates or attempts to terminate
the following user processes:
- ntvdm.exe
Modifies file system :
Creates the following files:
- C:\ComboFix\svc_wht.dat
- C:\ComboFix\svchost.dat
- C:\ComboFix\svchost.vista.dat
- C:\ComboFix\safeboot.dat
- C:\ComboFix\safeboot.def.dat
- C:\ComboFix\safeboot.def.vista.dat
- C:\ComboFix\zhsvc.dat
- C:\ComboFix\ERDNT.e_e
- C:\ComboFix\ERDNTDOS.LOC
- C:\ComboFix\system_ini.dat
- C:\ComboFix\whitedirB.dat
- C:\ComboFix\WhiteLegacy.dat
- C:\ComboFix\rogues.dat
- C:\ComboFix\ndis_combofix.dat
- C:\ComboFix\netsvc.bad.dat
- C:\ComboFix\netsvc.dat
- C:\ComboFix\LocalService.dat
- C:\ComboFix\LocalServiceNetworkRestricted.dat
- C:\ComboFix\LocalSystemNetworkRestricted.dat
- C:\ComboFix\Policies.dat
- C:\ComboFix\Purity.dat
- C:\ComboFix\region.dat
- C:\ComboFix\netsvc.vista.dat
- C:\ComboFix\netsvc.xp.dat
- C:\ComboFix\NetworkService.dat
- C:\ComboFix\path02
- C:\ComboFix\comspec00
- <SYSTEM32>\swxcacls.exe
- C:\ComboFix\NlsLang
- C:\ComboFix\path00
- C:\ComboFix\path01
- <SYSTEM32>\swreg.exe
- %WINDIR%\Nircmd.exe
- C:\ComboFix\regt.cfexe
- C:\ComboFix\errdbg.dat
- <SYSTEM32>\swsc.exe
- <SYSTEM32>\VFind.exe
- C:\ComboFix\erunt.dat
- C:\ComboFix\FProps.vbs
- C:\ComboFix\LFN.vbs
- C:\ComboFix\lnkread.vbs
- C:\ComboFix\ERDNTWIN.LOC
- C:\ComboFix\ERUNT.LOC
- C:\ComboFix\Exe.reg
- C:\ComboFix\SvcDrv.vbs
- C:\ComboFix\kmd.exe
- C:\ComboFix\osVer00
- C:\ComboFix\LocalDrive.vbs
- C:\ComboFix\OSid.vbs
- C:\ComboFix\restore_pt.vbs
- C:\ComboFix\executables.dat
- C:\ComboFix\SetEnvmt.bat
- C:\ComboFix\Sys.bat
- C:\ComboFix\upload.bat
- C:\ComboFix\NTP.bat
- C:\ComboFix\pid.bat
- C:\ComboFix\Qoo.bat
- C:\ComboFix\ComboFix.sys
- C:\ComboFix\BootSect
- C:\ComboFix\catchme.cfexe
- C:\ComboFix\nircmd.com
- C:\ComboFix\ntp.exe
- C:\ComboFix\NTPBack.exe
- C:\ComboFix\ND_.bat
- C:\ComboFix\Comspec.bat
- C:\ComboFix\DelClsid.bat
- C:\ComboFix\Disclaimer.bat
- C:\ComboFix\Boot.bat
- C:\ComboFix\Combobatch.bat
- C:\ComboFix\ComboFix.bat
- C:\ComboFix\Lang.bat
- C:\ComboFix\List-C.bat
- C:\ComboFix\MoveIt.bat
- C:\ComboFix\FIND3M.bat
- C:\ComboFix\FIXLSP.bat
- C:\ComboFix\history.bat
- C:\ComboFix\swreg.cfexe
- C:\ComboFix\swsc.cfexe
- C:\ComboFix\swxcacls.cfexe
- C:\ComboFix\sed.cfexe
- C:\ComboFix\setpath.cfexe
- C:\ComboFix\SF.cfexe
- C:\ComboFix\023v.dat
- C:\ComboFix\clsid.dat
- C:\ComboFix\Creg.dat
- C:\ComboFix\vfind.cfexe
- C:\ComboFix\zip.cfexe
- C:\ComboFix\023.dat
- C:\ComboFix\RestartIt.cfexe
- C:\ComboFix\extract.cfexe
- C:\ComboFix\fdsv.cfexe
- C:\ComboFix\grep.cfexe
- C:\ComboFix\dd.cfexe
- C:\ComboFix\dumphive.cfexe
- C:\ComboFix\ERUNT.cfexe
- C:\ComboFix\moveex.cfexe
- C:\ComboFix\mtee.cfexe
- C:\ComboFix\nircmd.cfexe
- C:\ComboFix\gsar.cfexe
- C:\ComboFix\handle.cfexe
- C:\ComboFix\ListDlls.cfexe
Deletes the following files:
- C:\ComboFix\osVer00
- C:\ComboFix\path02
- C:\ComboFix\svchost.vista.dat
- C:\ComboFix\netsvc.vista.dat
- C:\ComboFix\path01
- C:\ComboFix\Comspec.bat
- C:\ComboFix\NlsLang
- C:\ComboFix\path00
- C:\ComboFix\comspec00
Moves the following files:
- from C:\ComboFix\netsvc.xp.dat to C:\ComboFix\netsvc.dat
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'