Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '*WinMediaManager0' = '"%ALLUSERSPROFILE%\WinMediaManager0\taskeng.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe] 'Debugger' = 'wuauclt.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Firewall.cpl] 'Debugger' = 'wuauclt.exe'
Changes the following executable system files:
- <SYSTEM32>\mmc.exe.rz3b9m
- <SYSTEM32>\Firewall.cpl.9724E
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=disable profile=all
- '<SYSTEM32>\sc.exe' config SharedAccess start= disabled
Modifies file system :
Creates the following files:
- <SYSTEM32>\mmc.exe:Zone.Identifier
- %ALLUSERSPROFILE%\WinMediaManager0\vboxservice.exe
- %APPDATA%\stereoscope.sb
- <SYSTEM32>\firewall.cpl:Zone.Identifier
Sets the 'hidden' attribute to the following files:
- %ALLUSERSPROFILE%\WinMediaManager0\vboxservice.exe
Deletes the following files:
- <SYSTEM32>\xRZRzsZFfNtGOfj
- <SYSTEM32>\wokI[QYbmXTNCndHEQDSx
Moves the following system files:
- from <SYSTEM32>\kiWckOQZjvbQhqxHPb to <SYSTEM32>\qgRCQNQRCaoJqpkp
- from <SYSTEM32>\KXbeAVSXxxVFMceb to <SYSTEM32>\kiWckOQZjvbQhqxHPb
- from <SYSTEM32>\ThUTkOHDsGqnqY to <SYSTEM32>\WRevRXIocWIxHQ
- from <SYSTEM32>\qgRCQNQRCaoJqpkp to <SYSTEM32>\ThUTkOHDsGqnqY
- from <SYSTEM32>\mmc.exe.rz3b9m to <SYSTEM32>\qOyBpsSbQMjaPSxog
- from <SYSTEM32>\mmc.exe to <SYSTEM32>\mmc.exe.rz3b9m
- from <SYSTEM32>\eoeauoEVuObsQqvPr to <SYSTEM32>\KXbeAVSXxxVFMceb
- from <SYSTEM32>\qOyBpsSbQMjaPSxog to <SYSTEM32>\eoeauoEVuObsQqvPr
- from <SYSTEM32>\zwWvUtEUPPencpNHGh to <SYSTEM32>\UxkClcERxjnaRCpoR
- from <SYSTEM32>\YOwFrtKAQqDWUnuXq to <SYSTEM32>\zwWvUtEUPPencpNHGh
- from <SYSTEM32>\MBjzqaBl[gHAHgvq to <SYSTEM32>\xRZRzsZFfNtGOfj
- from <SYSTEM32>\UxkClcERxjnaRCpoR to <SYSTEM32>\MBjzqaBl[gHAHgvq
- from <SYSTEM32>\iTGSgIzxmVHGcozoGh to <SYSTEM32>\CGJoAOzdOLoZMYB
- from <SYSTEM32>\WRevRXIocWIxHQ to <SYSTEM32>\iTGSgIzxmVHGcozoGh
- from <SYSTEM32>\XObOSCrMHxdGRlK to <SYSTEM32>\YOwFrtKAQqDWUnuXq
- from <SYSTEM32>\CGJoAOzdOLoZMYB to <SYSTEM32>\XObOSCrMHxdGRlK
- from <SYSTEM32>\YlfmjdlrutTmTUZQbhBy to <SYSTEM32>\SzIzQqLjCYyRNQgYRYBNIg
- from <SYSTEM32>\pngyJYseHWhcxVClxyS to <SYSTEM32>\YlfmjdlrutTmTUZQbhBy
- from <SYSTEM32>\QSheXd[hclMoegauAf to <SYSTEM32>\rOIAJYBkNaNwGZsWQLRs
- from <SYSTEM32>\SzIzQqLjCYyRNQgYRYBNIg to <SYSTEM32>\QSheXd[hclMoegauAf
- from <SYSTEM32>\Firewall.cpl.9724E to <SYSTEM32>\MGMBcGyHVGVhHhGBSfD
- from <SYSTEM32>\firewall.cpl to <SYSTEM32>\Firewall.cpl.9724E
- from <SYSTEM32>\uZsfHJuaSScwNSOHlXbcUD to <SYSTEM32>\pngyJYseHWhcxVClxyS
- from <SYSTEM32>\MGMBcGyHVGVhHhGBSfD to <SYSTEM32>\uZsfHJuaSScwNSOHlXbcUD
- from <SYSTEM32>\RFAwzvmVqEhUlcSMUUicb to <SYSTEM32>\qlvYJetoyjXwuYJBuuLYzm
- from <SYSTEM32>\wnMDxrtJMpPZxzpJOXqg to <SYSTEM32>\RFAwzvmVqEhUlcSMUUicb
- from <SYSTEM32>\gWwppaKXklpiIDGsCsyO to <SYSTEM32>\wokI[QYbmXTNCndHEQDSx
- from <SYSTEM32>\qlvYJetoyjXwuYJBuuLYzm to <SYSTEM32>\gWwppaKXklpiIDGsCsyO
- from <SYSTEM32>\oQQOwpIdHKMecroXrZ to <SYSTEM32>\uJeiWAyUubxkfyIsZNpiFfo
- from <SYSTEM32>\rOIAJYBkNaNwGZsWQLRs to <SYSTEM32>\oQQOwpIdHKMecroXrZ
- from <SYSTEM32>\DjJMFKsgEyenqWJHATxRq to <SYSTEM32>\wnMDxrtJMpPZxzpJOXqg
- from <SYSTEM32>\uJeiWAyUubxkfyIsZNpiFfo to <SYSTEM32>\DjJMFKsgEyenqWJHATxRq
Moves itself:
- from <Full path to virus> to %ALLUSERSPROFILE%\WinMediaManager0\taskeng.exe
Network activity:
Connects to:
- 'li####easyhaha.ru':80
TCP:
HTTP POST requests:
- li####easyhaha.ru/5/page.php
UDP:
- DNS ASK li####easyhaha.ru
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''