Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System' = '<SYSTEM32>\wind32.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Executes the following:
- <SYSTEM32>\ntvdm.exe -f -i4
- <SYSTEM32>\ntvdm.exe -f -i5
- <SYSTEM32>\ntvdm.exe -f -i6
- <SYSTEM32>\ntvdm.exe -f -i3
- <SYSTEM32>\netsh.exe firewall set allowedprogram '<Full path to virus>' enable
- <SYSTEM32>\ntvdm.exe -f -i1
- <SYSTEM32>\ntvdm.exe -f -i2
Modifies file system :
Creates the following files:
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\adv67[1].php
- %WINDIR%\Temp\scs1.tmp
- <SYSTEM32>\dllgh8jkd1q7.exe
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scsA.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scsB.tmp
- <SYSTEM32>\vx.tll
- %TEMP%\3.dllb
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scs7.tmp
- %TEMP%\7.dllb
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\null[1].jpg
- <SYSTEM32>\dllgh8jkd1q8.exe
- <SYSTEM32>\dllgh8jkd1q1.exe
- %TEMP%\1.dllb
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\adload[1].php
- <SYSTEM32>\wind32.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\rftghjkljhgfdsdfgh[1].php
- %TEMP%\4.dllb
- %TEMP%\6.dllb
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\tool[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\proxy[1].jpg
- <SYSTEM32>\dllgh8jkd1q6.exe
- <SYSTEM32>\dllgh8jkd1q2.exe
- %TEMP%\2.dllb
- <SYSTEM32>\dllgh8jkd1q5.exe
- %TEMP%\5.dllb
Deletes the following files:
- %WINDIR%\Temp\scs6.tmp
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scsA.tmp
- %WINDIR%\Temp\scs7.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scsC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\null[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\tool[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\adload[1].php
- <SYSTEM32>\dllgh8jkd1q8.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\proxy[1].jpg
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\adv67[1].php
- %WINDIR%\Temp\scs3.tmp
Network activity:
Connects to:
- 'localhost':1039
- 'tr###ount.net':80
TCP:
HTTP GET requests:
- tr###ount.net/pic/tool.jpg
- tr###ount.net/pic/proxy.jpg
- tr###ount.net/qwertyuiyw12ertyuytre/adv67.php?ad###################################
- tr###ount.net/adv/067/adload.php?a1###########################################################################################################################################################################
- tr###ount.net/rftghjkljhgfdsdfgh.php?ad##########################
- tr###ount.net/pic/null.jpg
UDP:
- DNS ASK tr###ount.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ab4.ab8.3b0006'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-abc.ac4.3c0007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-acc.ad4.3d0005'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a80.a84.380001'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a88.a90.390002'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a98.aa0.3a0005'