Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'ctfmon' = '%WINDIR%\HIV\dwm.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\nao mecher.lnk
Malicious functions:
Creates and executes the following:
- '<Current directory>\Shortcut.exe' /f:"R:\nao mecher.lnk" /a:c /t:"R:\nao mecher\dwm.exe" /w:"R:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"S:\nao mecher.lnk" /a:c /t:"S:\nao mecher\dwm.exe" /w:"S:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"T:\nao mecher.lnk" /a:c /t:"T:\nao mecher\dwm.exe" /w:"T:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"O:\nao mecher.lnk" /a:c /t:"O:\nao mecher\dwm.exe" /w:"O:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"P:\nao mecher.lnk" /a:c /t:"P:\nao mecher\dwm.exe" /w:"P:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"Q:\nao mecher.lnk" /a:c /t:"Q:\nao mecher\dwm.exe" /w:"Q:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"X:\nao mecher.lnk" /a:c /t:"X:\nao mecher\dwm.exe" /w:"X:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"Y:\nao mecher.lnk" /a:c /t:"Y:\nao mecher\dwm.exe" /w:"Y:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"Z:\nao mecher.lnk" /a:c /t:"Z:\nao mecher\dwm.exe" /w:"Z:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"U:\nao mecher.lnk" /a:c /t:"U:\nao mecher\dwm.exe" /w:"U:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"V:\nao mecher.lnk" /a:c /t:"V:\nao mecher\dwm.exe" /w:"V:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"W:\nao mecher.lnk" /a:c /t:"W:\nao mecher\dwm.exe" /w:"W:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"F:\nao mecher.lnk" /a:c /t:"F:\nao mecher\dwm.exe" /w:"F:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"G:\nao mecher.lnk" /a:c /t:"G:\nao mecher\dwm.exe" /w:"G:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"H:\nao mecher.lnk" /a:c /t:"H:\nao mecher\dwm.exe" /w:"H:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"C:\nao mecher.lnk" /a:c /t:"C:\nao mecher\dwm.exe" /w:"C:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"<Drive name for removable media>:\nao mecher.lnk" /a:c /t:"<Drive name for removable media>:\nao mecher\dwm.exe" /w:"<Drive name for removable media>:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"E:\nao mecher.lnk" /a:c /t:"E:\nao mecher\dwm.exe" /w:"E:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"L:\nao mecher.lnk" /a:c /t:"L:\nao mecher\dwm.exe" /w:"L:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"M:\nao mecher.lnk" /a:c /t:"M:\nao mecher\dwm.exe" /w:"M:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"N:\nao mecher.lnk" /a:c /t:"N:\nao mecher\dwm.exe" /w:"N:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"I:\nao mecher.lnk" /a:c /t:"I:\nao mecher\dwm.exe" /w:"I:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"J:\nao mecher.lnk" /a:c /t:"J:\nao mecher\dwm.exe" /w:"J:\nao mecher" /i:SHELL32.dll,243
- '<Current directory>\Shortcut.exe' /f:"K:\nao mecher.lnk" /a:c /t:"K:\nao mecher\dwm.exe" /w:"K:\nao mecher" /i:SHELL32.dll,243
Executes the following:
- '<SYSTEM32>\attrib.exe' +s +h +r "R:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "R:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "Q:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "R:\nao mecher\" /h /y
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "S:\nao mecher\" /h /y
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "T:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "T:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "S:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "S:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "Q:\nao mecher"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "O:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "O:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "N:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "N:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "O:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "P:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "Q:\nao mecher\" /h /y
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "P:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "P:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "X:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "Y:\nao mecher\" /h /y
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "X:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "X:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "Y:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "Z:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "Z:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "Y:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "Z:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "W:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "U:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "U:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "T:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "U:\nao mecher\" /h /y
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "V:\nao mecher\" /h /y
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "W:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "W:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "V:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "V:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "E:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "F:\nao mecher\" /h /y
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "E:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "E:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "F:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "G:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "G:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "F:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "G:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "<Drive name for removable media>:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\Shortcut.exe <SYSTEM32>\ /h /y
- '<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v ctfmon /d %WINDIR%\HIV\dwm.exe /f
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\sc.cmd" "
- '<SYSTEM32>\ping.exe' -n 5 127.0.0.1
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "C:\nao mecher\" /h /y
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "<Drive name for removable media>:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "<Drive name for removable media>:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "C:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "C:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "L:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "L:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "K:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "K:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "L:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "M:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "N:\nao mecher\" /h /y
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "M:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "M:\nao mecher"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "K:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "H:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "I:\nao mecher\" /h /y
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "H:\nao mecher\" /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r "H:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "I:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "J:\nao mecher"
- '<SYSTEM32>\attrib.exe' +s +h +r "J:\nao mecher\dwm.exe"
- '<SYSTEM32>\attrib.exe' +s +h +r "I:\nao mecher\dwm.exe"
- '<SYSTEM32>\xcopy.exe' %WINDIR%\HIV\dwm.exe "J:\nao mecher\" /h /y
Modifies file system :
Creates the following files:
- C:\nao mecher.lnk
- <Current directory>\Shortcut.exe
- %TEMP%\1.tmp\sc.cmd
Deletes the following files:
- %TEMP%\1.tmp\sc.cmd
- <Current directory>\Shortcut.exe