Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '<DRIVERS>\spoolsv.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\AUTORUN.INF
- <Drive name for removable media>:\RECYCLER\S-1-5-21-1202660629-436374069-1417001333-1002\S-1-5-21-1409082233-764733703-1177238915-1002.exe
Malicious functions:
Creates and executes the following:
- <DRIVERS>\spoolsv.exe
Executes the following:
- <SYSTEM32>\net1.exe localgroup users HelpServiceGroup /delete
- <SYSTEM32>\net1.exe user HelpServiceGroup /expires:never /passwordchg:no
- <SYSTEM32>\net1.exe user HelpServiceGroup hacker /add
- <SYSTEM32>\net1.exe localgroup %USERNAME%s HelpServiceGroup /add
Modifies file system :
Creates the following files:
- <DRIVERS>\spoolsv.exe
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\AUTORUN.INF