Win32.Expiro.98

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\NetDDE] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\MSIServer] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\mnmsrvc] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\RDSessMgr] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\VSS] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\WmiApSrv] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\TlntSvr] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\idsvc] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\clr_optimization_v2.0.50727_32] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ClipSrv] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\CiSvc] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\clr_optimization_v4.0.30319_32] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ImapiService] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\dmadmin] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\COMSysApp] 'Start' = '00000002'

Changes the following executable system files:

<SYSTEM32>\vssvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
<SYSTEM32>\magnify.exe
<SYSTEM32>\wbem\wmiapsrv.exe
<SYSTEM32>\smlogsvc.exe
<SYSTEM32>\tlntsvr.exe
<SYSTEM32>\ups.exe
<SYSTEM32>\narrator.exe
<SYSTEM32>\tourstart.exe
<SYSTEM32>\rcimlby.exe
<SYSTEM32>\accwiz.exe
<SYSTEM32>\mobsync.exe
<SYSTEM32>\osk.exe
<SYSTEM32>\utilman.exe
<SYSTEM32>\notepad.exe
<SYSTEM32>\scardsvr.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
<SYSTEM32>\dllhost.exe
<SYSTEM32>\dmadmin.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
<SYSTEM32>\cisvc.exe
<SYSTEM32>\clipsrv.exe
<SYSTEM32>\imapi.exe
<SYSTEM32>\netdde.exe
<SYSTEM32>\sessmgr.exe
<SYSTEM32>\locator.exe
<SYSTEM32>\msiexec.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
<SYSTEM32>\mnmsrvc.exe
<SYSTEM32>\msdtc.exe

Infects the following executable files:

<SYSTEM32>\narrator.exe
<SYSTEM32>\magnify.exe
<SYSTEM32>\utilman.exe
<SYSTEM32>\osk.exe
<SYSTEM32>\wbem\wmiapsrv.exe
<SYSTEM32>\ups.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
<SYSTEM32>\vssvc.exe
%PROGRAM_FILES%\Outlook Express\wab.exe
%PROGRAM_FILES%\Outlook Express\msimn.exe
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE
<SYSTEM32>\accwiz.exe
<SYSTEM32>\rcimlby.exe
<SYSTEM32>\notepad.exe
%PROGRAM_FILES%\Windows Media Player\wmplayer.exe
<SYSTEM32>\tourstart.exe
<SYSTEM32>\mobsync.exe
<SYSTEM32>\tlntsvr.exe
<SYSTEM32>\dllhost.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
<SYSTEM32>\imapi.exe
<SYSTEM32>\dmadmin.exe
<SYSTEM32>\cisvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
<SYSTEM32>\clipsrv.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
<SYSTEM32>\locator.exe
<SYSTEM32>\sessmgr.exe
<SYSTEM32>\smlogsvc.exe
<SYSTEM32>\scardsvr.exe
<SYSTEM32>\msdtc.exe
<SYSTEM32>\mnmsrvc.exe
<SYSTEM32>\netdde.exe
<SYSTEM32>\msiexec.exe

Malicious functions:

Executes the following:

'<SYSTEM32>\dmadmin.exe' /com
'<SYSTEM32>\imapi.exe'
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe' -UseCLSID {7B368ACB-69BA-4824-A48D-C38CD832C23C} -Comment "NGen Worker Process"
'<SYSTEM32>\cisvc.exe'
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe'
'%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe'

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\Outlook Express\bqapdijg.tmp
<SYSTEM32>\hgonacka.tmp
%PROGRAM_FILES%\Windows Media Player\flfkpjga.tmp
<SYSTEM32>\pmimdkah.tmp
<SYSTEM32>\ckplekmo.tmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\almfjphb.tmp
<SYSTEM32>\lhjjmhqh.tmp
<SYSTEM32>\babbaidi.tmp
<SYSTEM32>\colnlaeg.tmp
<SYSTEM32>\fpomjeol.tmp
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{571c7873-cd35-cf2d-b846-20687f011a38}\install.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{571c7873-cd35-cf2d-b846-20687f011a38}\chrome.manifest
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{571c7873-cd35-cf2d-b846-20687f011a38}\chrome\content.jar
<SYSTEM32>\klncjook.tmp
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{571c7873-cd35-cf2d-b846-20687f011a38}\components\rooka.js
%PROGRAM_FILES%\Internet Explorer\ecgnbqfc.tmp
<SYSTEM32>\jmqkagnn.tmp
%PROGRAM_FILES%\Outlook Express\gpkmghmf.tmp
<LS_APPDATA>\wsr34zt32.dll
<SYSTEM32>\mljkfpbk.tmp
<SYSTEM32>\mmepclgp.tmp
<SYSTEM32>\fnpnhbni.tmp
<SYSTEM32>\agmjajbe.tmp
<SYSTEM32>\ifnmiqgj.tmp
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\dlebbbkl.tmp
<SYSTEM32>\achliokk.tmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\llhabhfn.tmp
<SYSTEM32>\oneoiibm.tmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\dmekhpnk.tmp
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\nipmeaik.tmp
<SYSTEM32>\bkdpdamo.tmp
<SYSTEM32>\kqdbhaiq.tmp
<SYSTEM32>\objffabl.tmp
<SYSTEM32>\wbem\bdfmkeqd.tmp
<SYSTEM32>\fdngehkk.tmp
<SYSTEM32>\hmngmkge.tmp
<SYSTEM32>\lpodaakn.tmp
<SYSTEM32>\jlgjjhba.tmp
<SYSTEM32>\lgpojmkc.tmp
<SYSTEM32>\mimmcldn.tmp

Deletes the following files:

<SYSTEM32>\colnlaeg.tmp
<SYSTEM32>\fpomjeol.tmp
%PROGRAM_FILES%\Outlook Express\bqapdijg.tmp
<SYSTEM32>\hgonacka.tmp
<SYSTEM32>\babbaidi.tmp
<SYSTEM32>\wbem\bdfmkeqd.tmp
<SYSTEM32>\fdngehkk.tmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\almfjphb.tmp
<SYSTEM32>\lhjjmhqh.tmp
<SYSTEM32>\mljkfpbk.tmp
%PROGRAM_FILES%\Outlook Express\gpkmghmf.tmp
<SYSTEM32>\klncjook.tmp
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite.new
%PROGRAM_FILES%\Internet Explorer\ecgnbqfc.tmp
<SYSTEM32>\ckplekmo.tmp
%PROGRAM_FILES%\Windows Media Player\flfkpjga.tmp
<SYSTEM32>\jmqkagnn.tmp
<SYSTEM32>\pmimdkah.tmp
<SYSTEM32>\mmepclgp.tmp
<SYSTEM32>\fnpnhbni.tmp
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\dlebbbkl.tmp
<SYSTEM32>\agmjajbe.tmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\dmekhpnk.tmp
<SYSTEM32>\achliokk.tmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\llhabhfn.tmp
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\nipmeaik.tmp
<SYSTEM32>\oneoiibm.tmp
<SYSTEM32>\kqdbhaiq.tmp
<SYSTEM32>\lgpojmkc.tmp
<SYSTEM32>\objffabl.tmp
<SYSTEM32>\bkdpdamo.tmp
<SYSTEM32>\mimmcldn.tmp
<SYSTEM32>\lpodaakn.tmp
<SYSTEM32>\ifnmiqgj.tmp
<SYSTEM32>\jlgjjhba.tmp
<SYSTEM32>\hmngmkge.tmp

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information