Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'ShuttleCsp11_3003' = '%ProgramFiles(x86)%\EnterSafe\ePass3003\shuttle_certd3003.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'ShuttleCsp11_3000GM' = '%ProgramFiles(x86)%\·ÉÌì³ÏÐÅ\ePass3000GM\certd3kGM.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\öõ¶ë°²è«×¼èëïµГВі.lnk
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\AutoDiskService] 'ImagePath' = '<SYSTEM32>\rundll32.exe <SYSTEM32>\SHUTTL~4.DLL,eb_service'
Creates the following services
- 'AutoDiskService' <SYSTEM32>\rundll32.exe <SYSTEM32>\SHUTTL~4.DLL,eb_service
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im shuttle_certd3003.exe /t
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\f8 icloud platform\config\all_function.xml
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\entersafe\epass3003\åäö㹤¾ß.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\entersafe\epass3003\В№ГјГ Г¹¤¾ß.lnk
- %WINDIR%\syswow64\shuttlecsp11_3003.dll
- %WINDIR%\syswow64\shuttlecsp11_3003_s.dll
- %WINDIR%\syswow64\shuttlecsp11_3003.sig
- %ProgramFiles(x86)%\entersafe\epass3003\lang\esmgr_2052.lng
- %ProgramFiles(x86)%\entersafe\epass3003\lang\esmgr_1033.lng
- %ProgramFiles(x86)%\entersafe\epass3003\lang\escfg_2052.lng
- %ProgramFiles(x86)%\entersafe\epass3003\lang\escfg_1033.lng
- %ProgramFiles(x86)%\entersafe\epass3003\lang\escsp_2052.lng
- %ProgramFiles(x86)%\entersafe\epass3003\lang\escsp_1033.lng
- %ProgramFiles(x86)%\entersafe\epass3003\lang\escertd_2052.lng
- %ProgramFiles(x86)%\entersafe\epass3003\lang\escertd_1033.lng
- %ProgramFiles(x86)%\entersafe\epass3003\epass3003.ini
- %ProgramFiles(x86)%\entersafe\epass3003\configtool_3003.exe
- %ProgramFiles(x86)%\entersafe\epass3003\epassmanager_3003.exe
- %ProgramFiles(x86)%\entersafe\epass3003\shuttle_certd3003.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\entersafe\epass3003\ð¶ôø.lnk
- %TEMP%\nsr7050.tmp
- %TEMP%\nsg7060.tmp\system.dll
- %TEMP%\nsg7060.tmp\userinfo.dll
- %TEMP%\certificates\cmca internalserverca.cer
- %TEMP%\certificates\cmca internal individual ca.cer
- %TEMP%\certificates\cmca internal root ca.cer
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\·éìì³ïðå\epass3000gm\ð¶ôøusbkeyВ№ГјГ Г¹¤¾ß.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\·éìì³ïðå\epass3000gm\usbkeyВ№ГјГ Г¹¤¾ß.lnk
- %WINDIR%\syswow64\shuttlecsp11_3000gm.dll
- %WINDIR%\syswow64\shuttlecsp11_3000gm_s.dll
- %WINDIR%\syswow64\shuttlecsp11_3000gm.sig
- %ProgramFiles(x86)%\·éìì³ïðå\epass3000gm\lang\esmgr_1033.lng
- %ProgramFiles(x86)%\·éìì³ïðå\epass3000gm\lang\esmgr_2052.lng
- %ProgramFiles(x86)%\·éìì³ïðå\epass3000gm\lang\escsp_2052.lng
- %ProgramFiles(x86)%\·éìì³ïðå\epass3000gm\lang\escsp_1033.lng
- %ProgramFiles(x86)%\·éìì³ïðå\epass3000gm\lang\escertd_2052.lng
- %ProgramFiles(x86)%\·éìì³ïðå\epass3000gm\lang\escertd_1033.lng
- %ProgramFiles(x86)%\·éìì³ïðå\epass3000gm\certd3kgm.exe
- %ProgramFiles(x86)%\·éìì³ïðå\epass3000gm\shuttlecsp11_3000gm_s.reg
- %TEMP%\nsg7060.tmp\ieusecertenroll.dll
- %ProgramFiles(x86)%\·éìì³ïðå\epass3000gm\uninst.exe
- %TEMP%\certificates\ams.cer
- %ProgramFiles(x86)%\entersafe\epass3003\shuttlecsp11_3003_s.reg
- %TEMP%\reghiddevice.dll
- %ProgramFiles(x86)%\entersafe\epass3003\uninst.exe
- %ProgramFiles(x86)%\f8 icloud platform\certificates\sm2_cmca_root_ca.der.cer
- %ProgramFiles(x86)%\f8 icloud platform\certificates\rsa_rootca.der.cer
- %ProgramFiles(x86)%\f8 icloud platform\certificates\rsa_cmca_server_ca.der.cer
- %ProgramFiles(x86)%\f8 icloud platform\certificates\rsa_cmca_root_ca.der.cer
- %ProgramFiles(x86)%\f8 icloud platform\certificates\rsa_cmca_individual_ca.der.cer
- %ProgramFiles(x86)%\f8 icloud platform\certificates\cmca internalserverca.cer
- %ProgramFiles(x86)%\f8 icloud platform\certificates\cmca internal root ca.cer
- %ProgramFiles(x86)%\f8 icloud platform\certificates\cmca internal individual ca.cer
- %ProgramFiles(x86)%\f8 icloud platform\ui\logo_small.png
- %ProgramFiles(x86)%\f8 icloud platform\ui\logo_large.png
- %ProgramFiles(x86)%\f8 icloud platform\ui\thirdvalues.xml
- %ProgramFiles(x86)%\f8 icloud platform\config\ustorcfg.xml
- %ProgramFiles(x86)%\f8 icloud platform\config\sysfilter.xml
- %ProgramFiles(x86)%\f8 icloud platform\config\plugin.xml
- %ProgramFiles(x86)%\f8 icloud platform\config\pisces.xml
- %ProgramFiles(x86)%\f8 icloud platform\config\module.xml
- %ProgramFiles(x86)%\f8 icloud platform\config\data.dat
- %ProgramFiles(x86)%\f8 icloud platform\certificates\sm2_rootca.der.cer
- %ProgramFiles(x86)%\f8 icloud platform\certificates\ams.cer
- %ProgramFiles(x86)%\f8 icloud platform\bin\4acertupdate.dll
- %ProgramFiles(x86)%\f8 icloud platform\bin\4acertupdate.exe
- %TEMP%\nsb5043.tmp\system.dll
- %TEMP%\nsm5033.tmp
- nul
- %TEMP%\nsw4f.tmp\nsexec.dll
- C:\filesecurity\serverinfo.xml
- %WINDIR%\ssohook.dll
- %WINDIR%\ssocontainer.dll
- %WINDIR%\sso.inf
- %ProgramFiles(x86)%\f8 icloud platform\bin\sso.inf
- %WINDIR%\sso.exe
- %ProgramFiles(x86)%\f8 icloud platform\bin\sso.exe
- %ProgramFiles(x86)%\f8 icloud platform\bin\epass3003.exe
- %ProgramFiles(x86)%\f8 icloud platform\bin\epass3000gm.exe
- %ProgramFiles(x86)%\f8 icloud platform\bin\certupdata.bat
- %ProgramFiles(x86)%\f8 icloud platform\bin\ssohook.dll
- %ProgramFiles(x86)%\f8 icloud platform\bin\ssocontainer.dll
- %ProgramFiles(x86)%\f8 icloud platform\bin\f6sh2.bat
- %ProgramFiles(x86)%\f8 icloud platform\bin\f6sh1.bat
- %TEMP%\nsb5043.tmp\userinfo.dll
- %TEMP%\nsw4f.tmp\system.dll
Deletes the following files
- %TEMP%\nsb5043.tmp\system.dll
- %TEMP%\nsb5043.tmp\userinfo.dll
- %ProgramFiles(x86)%\·éìì³ïðå\epass3000gm\shuttlecsp11_3000gm_s.reg
- %TEMP%\nsg7060.tmp\ieusecertenroll.dll
- %TEMP%\nsg7060.tmp\system.dll
- %TEMP%\nsg7060.tmp\userinfo.dll
- %TEMP%\nsw4f.tmp\nsexec.dll
- %TEMP%\nsw4f.tmp\system.dll
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\f8 icloud platform\bin\epass3003.exe' /S
- '%ProgramFiles(x86)%\entersafe\epass3003\shuttle_certd3003.exe'
- '%ProgramFiles(x86)%\f8 icloud platform\bin\epass3000gm.exe' /S
- '%ProgramFiles(x86)%\·éìì³ïðå\epass3000gm\certd3kgm.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles(x86)%\F8 iCloud Platform\bin\F6Sh1.bat""' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles(x86)%\F8 iCloud Platform\bin\F6Sh2.bat""' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles(x86)%\F8 iCloud Platform\bin\F6Sh1.bat""
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v 1609 /t REG_DWORD /d "0" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range7 /v https /t REG_DWORD /d "00000002" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range7 /v :Range /t REG_SZ /d "10.154.61.144" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range7 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range6 /v https /t REG_DWORD /d "00000002" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range6 /v :Range /t REG_SZ /d "10.154.61.143" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range6 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range5 /v https /t REG_DWORD /d "00000002" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range5 /v :Range /t REG_SZ /d "10.154.61.141" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range5 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range4 /v https /t REG_DWORD /d "00000002" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range4 /v :Range /t REG_SZ /d "10.154.61.140" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range4 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range3 /v http /t REG_DWORD /d "00000002" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range3 /v :Range /t REG_SZ /d "10.154.61.137" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range3 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range2 /v http /t REG_DWORD /d "00000002" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range2 /v :Range /t REG_SZ /d "10.154.61.136" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range2 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range1 /v http /t REG_DWORD /d "00000002" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range1 /v :Range /t REG_SZ /d "127.0.0.1" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"\Range1 /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles(x86)%\F8 iCloud Platform\bin\F6Sh2.bat""
- '%WINDIR%\syswow64\regedit.exe' /s "%ProgramFiles(x86)%\EnterSafe\ePass3003\shuttleCsp11_3003_s.reg"
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\SHUTTL~4.DLL,eb_service