Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '<SYSTEM32>\sessmgr.exe' = '<SYSTEM32>\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\sessmgr.exe' = '<SYSTEM32>\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019'
Executes the following:
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="Open Port 21" dir=in action=allow protocol=ALL localport=21
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="Open Port 135" dir=in action=allow protocol=ALL localport=135
- <SYSTEM32>\netsh.exe advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="Open Port 139" dir=in action=allow protocol=ALL localport=139
- <SYSTEM32>\secedit.exe /configure /db "%WINDIR%\pol.db" /cfg "%WINDIR%\pol.inf" /overwrite /quiet
- <SYSTEM32>\secedit.exe /configure /db "%WINDIR%\pol.db" /cfg "%WINDIR%\pol.inf" /quiet
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="Open Port 445" dir=in action=allow protocol=ALL localport=445
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow
- <SYSTEM32>\netsh.exe firewall add portopening ALL 135 "Open Port 135"
- <SYSTEM32>\netsh.exe firewall set service FileAndPrint
- <SYSTEM32>\netsh.exe firewall set icmpsetting type=ALL mode=enable
- <SYSTEM32>\netsh.exe firewall add portopening ALL 139 "Open Port 139"
- <SYSTEM32>\netsh.exe firewall set opmode DISABLE
- <SYSTEM32>\netsh.exe firewall add portopening ALL 21 "Open Port 21"
- <SYSTEM32>\netsh.exe firewall add portopening ALL 445 "Open Port 445"
Modifies file system :
Creates the following files:
- %WINDIR%\security\tmp.edb
- %WINDIR%\security\edb.log
- %WINDIR%\pol.db
- %WINDIR%\security\edb.chk
- %WINDIR%\security\res1.log
- %WINDIR%\pol.inf
- %TEMP%\tmp1.tmp
- %WINDIR%\security\res2.log
- %WINDIR%\security\edbtmp.log
Deletes the following files:
- %WINDIR%\pol.inf
- %WINDIR%\pol.db
- %TEMP%\tmp1.tmp
Moves the following files:
- from %WINDIR%\security\edbtmp.log to %WINDIR%\security\edb.log
Network activity:
UDP:
- 'localhost':1061
- 'localhost':1060
- '23#.#55.255.250':1900