Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\07367941\cwn.exe %TEMP%\07367941\bfh=vrp'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
blocks the following features:
- User Account Control (UAC)
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\07367941\ifm.docx
- %TEMP%\07367941\oni.mp3
- %TEMP%\07367941\ipw.mp4
- %TEMP%\07367941\xwr.mp3
- %TEMP%\07367941\ari.mp3
- %TEMP%\07367941\hrk.bmp
- %TEMP%\07367941\nek.icm
- %TEMP%\07367941\kee.mp3
- %TEMP%\07367941\amh.ico
- %TEMP%\07367941\lfx.txt
- %TEMP%\07367941\eqv.icm
- %TEMP%\07367941\mob.docx
- %TEMP%\07367941\lav.ico
- %TEMP%\07367941\vso.dat
- %TEMP%\07367941\hpp.xl
- %TEMP%\07367941\eur.docx
- %APPDATA%\remcos\logs.dat
- %TEMP%\07367941\ini
- %TEMP%\07367941\MQVUS
- %TEMP%\07367941\wew.ppt
- %TEMP%\07367941\dtg.bmp
- %TEMP%\07367941\iuo.ppt
- %TEMP%\07367941\lso.bmp
- %TEMP%\07367941\wwu.mp4
- %TEMP%\07367941\mss.docx
- %TEMP%\07367941\igg.ppt
- %TEMP%\07367941\jld.dat
- %TEMP%\07367941\ddj.ppt
- %TEMP%\07367941\snp.bmp
- %TEMP%\07367941\xdw.pdf
- %TEMP%\07367941\ure.mp3
- %TEMP%\07367941\fwv.mp4
- %TEMP%\07367941\xcc.dat
- %TEMP%\07367941\wjj.xl
- %TEMP%\07367941\cwn.exe
- %TEMP%\07367941\bfh=vrp
- %TEMP%\07367941\kfx.pdf
- %TEMP%\07367941\bub.ico
- %TEMP%\07367941\kei.jpg
- %TEMP%\07367941\kwg.pdf
- %TEMP%\07367941\ifg.xl
- %TEMP%\07367941\evi.bmp
- %TEMP%\07367941\mlo.mp4
- %TEMP%\07367941\wjd.jpg
- %TEMP%\07367941\elv.pdf
- %TEMP%\07367941\ipf.pdf
- %TEMP%\07367941\bxt.ppt
- %TEMP%\07367941\rhi.xl
- %TEMP%\07367941\qrb.bmp
- %TEMP%\07367941\amv.jpg
- %TEMP%\07367941\ivm.ppt
- %TEMP%\07367941\saw.txt
- %TEMP%\07367941\bsf.jpg
Sets the 'hidden' attribute to the following files:
- %TEMP%\07367941\mob.docx
- %TEMP%\07367941\mlo.mp4
- %TEMP%\07367941\lso.bmp
- %TEMP%\07367941\oni.mp3
- %TEMP%\07367941\nek.icm
- %TEMP%\07367941\mss.docx
- %TEMP%\07367941\kfx.pdf
- %TEMP%\07367941\kei.jpg
- %TEMP%\07367941\kee.mp3
- %TEMP%\07367941\lfx.txt
- %TEMP%\07367941\lav.ico
- %TEMP%\07367941\kwg.pdf
- %TEMP%\07367941\qrb.bmp
- %TEMP%\07367941\wwu.mp4
- %TEMP%\07367941\wjj.xl
- %TEMP%\07367941\wjd.jpg
- %TEMP%\07367941\xwr.mp3
- %TEMP%\07367941\xdw.pdf
- %TEMP%\07367941\xcc.dat
- %TEMP%\07367941\snp.bmp
- %TEMP%\07367941\saw.txt
- %TEMP%\07367941\rhi.xl
- %TEMP%\07367941\wew.ppt
- %TEMP%\07367941\vso.dat
- %TEMP%\07367941\ure.mp3
- %TEMP%\07367941\ddj.ppt
- %TEMP%\07367941\cwn.exe
- %TEMP%\07367941\bxt.ppt
- %TEMP%\07367941\eqv.icm
- %TEMP%\07367941\elv.pdf
- %TEMP%\07367941\dtg.bmp
- %TEMP%\07367941\ari.mp3
- %TEMP%\07367941\amv.jpg
- %TEMP%\07367941\amh.ico
- %TEMP%\07367941\bub.ico
- %TEMP%\07367941\bsf.jpg
- %TEMP%\07367941\bfh=vrp
- %TEMP%\07367941\eur.docx
- %TEMP%\07367941\ipw.mp4
- %TEMP%\07367941\ipf.pdf
- %TEMP%\07367941\igg.ppt
- %TEMP%\07367941\jld.dat
- %TEMP%\07367941\ivm.ppt
- %TEMP%\07367941\iuo.ppt
- %TEMP%\07367941\hpp.xl
- %TEMP%\07367941\fwv.mp4
- %TEMP%\07367941\evi.bmp
- %TEMP%\07367941\ifm.docx
- %TEMP%\07367941\ifg.xl
- %TEMP%\07367941\hrk.bmp
Deletes the following files:
- %TEMP%\07367941\MQVUS
Network activity:
Connects to:
- 'me####h.hopto.org':2120
UDP:
- DNS ASK me####h.hopto.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\07367941\cwn.exe' %TEMP%\07367941\MQVUS
- '%TEMP%\07367941\cwn.exe' bfh=vrp
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
