Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\pagefile.pif
- <Drive name for removable media>:\AUTORUN.INF
Malicious functions:
Creates and executes the following:
- <SYSTEM32>\Com\smss.exe
- <SYSTEM32>\Com\lsass.exe
- %TEMP%\RarSFX0\Setup.exe
Executes the following:
- <SYSTEM32>\cacls.exe <SYSTEM32>\com\lsass.exe /e /t /g Everyone:F
- <SYSTEM32>\cacls.exe <SYSTEM32>\com\smss.exe /e /t /g %USERNAME%:F
- <SYSTEM32>\cacls.exe <SYSTEM32>\com\smss.exe /e /t /g Everyone:F
- <SYSTEM32>\cacls.exe <SYSTEM32>\com\lsass.exe /e /t /g %USERNAME%:F
- <SYSTEM32>\cacls.exe <SYSTEM32>\com /e /t /g %USERNAME%:F
- <SYSTEM32>\cacls.exe <SYSTEM32>\com /e /t /g Everyone:F
- <SYSTEM32>\regsvr32.exe <SYSTEM32>\com\netcfg.dll /s
Terminates or attempts to terminate
the following user processes:
- AVPCC.EXE
- AVPM.EXE
- GUARD.EXE
- AVP.COM
- AVP.EXE
- AVP32.EXE
Modifies file system :
Creates the following files:
- <SYSTEM32>\182485.log
- C:\037589.log
- <SYSTEM32>\dnsq.dll
- C:\pagefile.pif
- C:\AUTORUN.INF
- <SYSTEM32>\Com\lsass.exe
- C:\NetApi000.sys
- %TEMP%\RarSFX0\Setup.exe
- <SYSTEM32>\Com\smss.exe
- <SYSTEM32>\Com\netcfg.dll
- <SYSTEM32>\Com\netcfg.000
Sets the 'hidden' attribute to the following files:
- C:\AUTORUN.INF
- <SYSTEM32>\dnsq.dll
- C:\pagefile.pif
- <Drive name for removable media>:\pagefile.pif
- <Drive name for removable media>:\AUTORUN.INF
- C:\037589.log
- <SYSTEM32>\Com\smss.exe
- C:\NetApi000.sys
- <SYSTEM32>\Com\netcfg.000
- <SYSTEM32>\Com\lsass.exe
- <SYSTEM32>\Com\netcfg.dll
Deletes the following files:
- %TEMP%\RarSFX0\Setup.exe
- C:\NetApi000.sys
Miscellaneous:
Searches for the following windows:
- ClassName: 'fg' WindowName: 'gg'
- ClassName: 'gg' WindowName: 'ff'
- ClassName: '#32770' WindowName: 'MCI Program Com Application'
- ClassName: 'XOR' WindowName: 'MSICTFIME SMSS'
- ClassName: 'dd' WindowName: 'gg'
- ClassName: '' WindowName: '????'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'XOR' WindowName: 'MSCTFIME SMSS'
- ClassName: '' WindowName: '@@????'
- ClassName: '' WindowName: 'SREng ????'