Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '365' = 'h:\svchosto.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '366' = 'C:\svchosto.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2297F138' = '%WINDIR%\2297F138\svchsot.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '364' = 'g:\svchosto.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '360' = '<SYSTEM32>\svchosto.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '362' = '<Drive name for removable media>:\svchosto.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '363' = 'f:\svchosto.exe'
Creates or modifies the following files:
- %WINDIR%\Tasks\At10.job
- %WINDIR%\Tasks\At9.job
- %WINDIR%\Tasks\At8.job
- %WINDIR%\Tasks\At13.job
- %WINDIR%\Tasks\At12.job
- %WINDIR%\Tasks\At11.job
- %WINDIR%\Tasks\At7.job
- %WINDIR%\Tasks\At3.job
- %WINDIR%\Tasks\At2.job
- %WINDIR%\Tasks\At1.job
- %WINDIR%\Tasks\At6.job
- %WINDIR%\Tasks\At5.job
- %WINDIR%\Tasks\At4.job
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ZHQHLPUZ] 'ImagePath' = '<DRIVERS>\ZHQHLPUZ.sys'
Creates the following files on removable media:
- <Drive name for removable media>:\AutoRun.inf
- <Drive name for removable media>:\svchosto.exe
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\system.\svchosttt.exe'
- '<SYSTEM32>\ksbinstaller_s_80_60899.exe'
- '<SYSTEM32>\svchosttt.exe'
- '<SYSTEM32>\KAVSETUPS_44_60899.exe'
- '<SYSTEM32>\svchoppp.exe'
- 'C:\PPTV(pplive)_fora5_60899.exe'
- '<SYSTEM32>\KAVSETUPS_44_60899.exe' (downloaded from the Internet)
- 'C:\PPTV(pplive)_fora5_60899.exe' (downloaded from the Internet)
- '<SYSTEM32>\ksbinstaller_s_80_60899.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\net1.exe' start "Task Scheduler"
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\drwtsn32.exe
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtWriteVirtualMemory, handler: ZHQHLPUZ.sys
- NtReadVirtualMemory, handler: ZHQHLPUZ.sys
- NtOpenProcess, handler: ZHQHLPUZ.sys
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- <SYSTEM32>\ksbinstaller_s_80_60899.exe
- %WINDIR%\0C24_svchosttt.exe_0.ndmp
- C:\PPTV(pplive)_fora5_60899.exe
- <SYSTEM32>\KAVSETUPS_44_60899.exe
- %WINDIR%\2297F138\svchsot.exe
- <SYSTEM32>\system.\svchosttt.exe
- <SYSTEM32>\svchosto.exe
- C:\AutoRun.inf
- <DRIVERS>\TMXMQTVA.sys
- %WINDIR%\svchoppp.exe
- <DRIVERS>\ZHQHLPUZ.sys
- <SYSTEM32>\svchoppp.exe
- C:\setups_66_63962.exe
- <SYSTEM32>\svchosttt.exe
- C:\kuping_s_33717.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\2345[1]
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\AutoRun.inf
- C:\AutoRun.inf
Deletes the following files:
- <SYSTEM32>\svchosto.exe
- <DRIVERS>\ZHQHLPUZ.sys
Network activity:
Connects to:
- 's1.##min6.com':80
- 'localhost':2012
- 'd.#####.ijinshan.com':80
- 'localhost':1037
- 'www.23##.com':80
TCP:
HTTP GET requests:
- s1.##min6.com/pptv/PPTV(pplive)_fora5_60899.exe
- d.#####.ijinshan.com/duba/link/KAVSETUPS_44_60899.exe
- d.#####.ijinshan.com/liebao/link/ksbinstaller_s_80_60899.exe
- www.23##.com/?k6#######
- d.#####.ijinshan.com/kuping/jm/kuping_s_33717.exe
- d.#####.ijinshan.com/weishi/link/setups_66_63962.exe
UDP:
- DNS ASK cd#.###ent.baidu.com
- DNS ASK do####ad.wuji.com
- DNS ASK qw####800.gicp.net
- DNS ASK ji#####wnload.2345.cn
- DNS ASK www.23##.com
- DNS ASK d.#####.ijinshan.com
- DNS ASK s1.##min6.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Button' WindowName: '????(&I)'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '#32770' WindowName: '2345????????????V3.2??????????60??????????????????'