Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Command Processor] 'AutoRun' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\cacls.exe"'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\cacls.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'cacls' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\cacls.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'cacls' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\cacls.exe"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\cacls.lnk
Malicious functions:
Creates and executes the following:
- '%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\cacls.exe'
- '<Full path to file>'
Executes the following:
- '<SYSTEM32>\taskkill.exe' /t /f /im "<File name>.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /t /f /im "<File name>.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "<Full path to file>" > NUL
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
- %APPDATA%\Canary
- %APPDATA%\commons-logging.NOTICE.txt
- %APPDATA%\create.js
- %APPDATA%\EUC-V
- %APPDATA%\chunk.append.xml
- %APPDATA%\default_bool.js
- %APPDATA%\EmbeddingExampleXML2FO.png
- %APPDATA%\getOpenDocumentIDs.jsx
- %APPDATA%\dash.js
- %APPDATA%\banner.before.navigation.xml
- %APPDATA%\12.gif
- %APPDATA%\cd.png
- %APPDATA%\78-RKSJ-V
- %APPDATA%\Anguilla
- %APPDATA%\Travelog.n
- %APPDATA%\app_updater_footer.png
- %APPDATA%\body.attributes.xml
- %TEMP%\nsr6.tmp
- %APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\cacls.exe
- %APPDATA%\IP.dll
- %APPDATA%\column.count.body.xml
- %APPDATA%\download_9.ico
- %APPDATA%\COPYING
- %APPDATA%\Detail Plastic - Black.3PP
- %APPDATA%\generate.toc.xml
- %APPDATA%\alert.jsx
- %APPDATA%\chunk-changebars.xsl
- %APPDATA%\download_7.ico
- %APPDATA%\excluded.txt
- %APPDATA%\dsc_backup_tile.png
- %APPDATA%\accelerometer.png
- %APPDATA%\bin.js
- %APPDATA%\Copenhagen
- %APPDATA%\chunk-website.xsl
- %APPDATA%\Athens
- %APPDATA%\ObitSilkworm.M
- %TEMP%\nsr2.tmp
- %APPDATA%\f15.png
- %APPDATA%\dsc_notifications_alert_tile.png
- %APPDATA%\404-6.htm
- %APPDATA%\adjmat.mpl
- %APPDATA%\footnote.number.format.xml
- %APPDATA%\Chongqing
- %APPDATA%\ebnf.table.border.xml
- %APPDATA%\Adobe-GB1-2
- %APPDATA%\divide.js
- %APPDATA%\GMT-5
- %APPDATA%\currency.data
- %APPDATA%\blue 286 bl 1.ADO
- %APPDATA%\eseadebug.log
- %APPDATA%\calendar2.png
- %APPDATA%\Darker.blw
- %APPDATA%\disabled.png
- %APPDATA%\female.png
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
