Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\services\NetDDESER] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\services\Evntconnections] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\inf\nvsvc32.exe' delete Evntconnections
- '%WINDIR%\inf\nvsvc32.exe' 0x654 nvsvc32.exe
- '%WINDIR%\inf\nvsvc32.exe' start Evntconnections
- '%WINDIR%\inf\nvsvc.exe'
- '%WINDIR%\inf\nvsvc32.exe'
Executes the following:
- '<SYSTEM32>\conhost.exe' stop Evntconnections
- '<SYSTEM32>\conhost.exe' /c ren nvsvc32.exe 5,795186
- '<SYSTEM32>\sc.exe' /pid=0x124 /log
- '<SYSTEM32>\sc.exe' 0x7dc sc.exe
- '<SYSTEM32>\sc.exe' /pid=0xa44 /log
- '<SYSTEM32>\sc.exe' 0x7f4 sc.exe
- '<SYSTEM32>\sc.exe'
- '<SYSTEM32>\sc.exe' 0xac0 sc.exe
- '<SYSTEM32>\sc.exe' 0xb30 sc.exe
- '<SYSTEM32>\conhost.exe' start Evntconnections
- '<SYSTEM32>\sc.exe' 0xcc4 sc.exe
- '<SYSTEM32>\sc.exe' 0xac4 sc.exe
- '<SYSTEM32>\sc.exe' /pid=0x604 /log
- '<SYSTEM32>\conhost.exe' /c ren nvsvc32.exe 3,01948
- '<SYSTEM32>\sc.exe' /pid=0xa1c /log
- '<SYSTEM32>\sc.exe' 0x4ec sc.exe
- '<SYSTEM32>\conhost.exe' /c ren nvsvc32.exe 2,895625
- '<SYSTEM32>\conhost.exe'
- '<SYSTEM32>\conhost.exe' description Evntconnections "?????????????????????,???????,??????????"
- '<SYSTEM32>\sc.exe' 0x3ec sc.exe
- '<SYSTEM32>\conhost.exe' /c %WINDIR%\inf\bftmp.bat
- '<SYSTEM32>\conhost.exe' /c %WINDIR%\inf\bfdde.bat
- '<SYSTEM32>\UI0Detect.exe'
- '<SYSTEM32>\sc.exe' delete NetDDESER
- '<SYSTEM32>\sc.exe' /pid=0xa28 /log
- '<SYSTEM32>\sc.exe' create NetDDESER BinPath= %WINDIR%\inf\WINNET type= own type= interact start= auto DisplayName= "Network DDE Service"
- '<SYSTEM32>\sc.exe' delete Evntconnections
- '<SYSTEM32>\sc.exe' stop Evntconnections
- '<SYSTEM32>\sc.exe' create Evntconnections BinPath= "%WINDIR%\inf\nvsvc32.exe" type= own type= interact start= auto DisplayName= "Evnt connections"
- '<SYSTEM32>\sc.exe' start Evntconnections
- '<SYSTEM32>\sc.exe' description Evntconnections "?????????????????????,???????,??????????"
- '<SYSTEM32>\taskhost.exe' start Evntconnections
- '<SYSTEM32>\sc.exe' 0x370 sc.exe
- '<SYSTEM32>\sc.exe' /pid=0x8c4 /log
- '<SYSTEM32>\sc.exe' /c ren nvsvc32.exe 5,33424
- '<SYSTEM32>\sc.exe' 0xa44 sc.exe
- '<SYSTEM32>\sc.exe' description NetDDESER "???????????????????????????? (DDE) ?????????????????, DDE ??????????????????,??????????????"
- '<SYSTEM32>\sc.exe' 0xa28 sc.exe
- '<SYSTEM32>\sc.exe' 0xa98 sc.exe
- '<SYSTEM32>\conhost.exe' delete Evntconnections
- '<SYSTEM32>\conhost.exe' create Evntconnections BinPath= "%WINDIR%\inf\nvsvc32.exe" type= own type= interact start= auto DisplayName= "Evnt connections"
Modifies file system :
Creates the following files:
- %WINDIR%\inf\svc.bat
- %WINDIR%\inf\bftmp.bat
- <Auxiliary element>
- %WINDIR%\inf\bfdde.bat
- %WINDIR%\inf\nvsvc32.exe
- %WINDIR%\inf\nvsvc.exe
- <Current directory>\tmp.bat
- <SYSTEM32>\NTSVC.ocx
Deletes the following files:
- %WINDIR%\Temp\~DFE0A9E7A1120DE428.TMP
- %WINDIR%\Temp\~DF3B205A337AA06AE2.TMP
- %WINDIR%\Temp\~DF48D39290372112FE.TMP
- %WINDIR%\inf\bfdde.bat
- %WINDIR%\Temp\~DF5E0F7A1673EDE85C.TMP
Moves itself:
- from <Full path to virus> to <Current directory>\tmp.exe
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Tlkwks'
- ClassName: '' WindowName: 'ENT58VIP2008'
- ClassName: '' WindowName: '??????'
- ClassName: '' WindowName: 'IM'
- ClassName: '' WindowName: 'iexplorer'
- ClassName: '$$$UI0Background' WindowName: ''
- ClassName: '' WindowName: 'iexplores'
- ClassName: '' WindowName: 'inf'
- ClassName: '' WindowName: 'WINNET - ??????'
- ClassName: '' WindowName: 'rejoice'
- ClassName: '' WindowName: '???'
- ClassName: '' WindowName: 'WINNET: WINNET - ??????'
- ClassName: '' WindowName: 'nvsvc32.exe - ??????'
- ClassName: '' WindowName: 'WINNET'
- ClassName: '' WindowName: 'WINNET:WINNET - ??????'