Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\wins] 'ImagePath' = '%CommonProgramFiles%\Microsoft Shared\MSINFO\2009.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\wins] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '<SYSTEM32>\mstsc.exe'
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
Injects code into
the following system processes:
- <SYSTEM32>\mstsc.exe
the following user processes:
- IEXPLORE.EXE
Modifies file system:
Creates the following files:
- C:\2009.exe
- %ProgramFiles%\_2009.exe
- C:\AutoRun.inf
- %CommonProgramFiles%\Microsoft Shared\MSInfo\SetupWay.txt
- %CommonProgramFiles%\Microsoft Shared\MSInfo\2009.exe
Sets the 'hidden' attribute to the following files:
- C:\2009.exe
- %ProgramFiles%\_2009.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\2009.exe
- C:\AutoRun.inf
Deletes the following files:
- %CommonProgramFiles%\Microsoft Shared\MSInfo\SetupWay.txt
Deletes itself.
Network activity:
Connects to:
- 'wi###.3322.org':8181
UDP:
- DNS ASK wi###.3322.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'TNewyearSaxi' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'TAppBuilder' WindowName: ''
