Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'LAN Service' = '%ProgramFiles%\LAN Service\lansv.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\50657287\wxi.exe %TEMP%\50657287\obi=dvf'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\50657287\ose.ppt
- %TEMP%\50657287\ehx.txt
- %TEMP%\50657287\liq.dat
- %TEMP%\50657287\iih.bmp
- %TEMP%\50657287\xjf.xl
- %TEMP%\50657287\thb.icm
- %TEMP%\50657287\mar.icm
- %TEMP%\50657287\psw.bmp
- %TEMP%\50657287\mjm.docx
- %TEMP%\50657287\inh.pdf
- %TEMP%\50657287\rju.ppt
- %TEMP%\50657287\vvr.ico
- %TEMP%\50657287\qan.dat
- %TEMP%\50657287\ooe.dat
- %TEMP%\50657287\oen.docx
- %TEMP%\50657287\emq.ico
- %ProgramFiles%\LAN Service\lansv.exe
- %APPDATA%\23EF5514-3059-436F-A4A7-4CEFAAB20EB1\run.dat
- %TEMP%\50657287\EMJGH
- %TEMP%\50657287\rsj.pdf
- %TEMP%\50657287\phu.dat
- %TEMP%\50657287\svq.dat
- %TEMP%\50657287\nau.mp4
- %TEMP%\50657287\hsc.icm
- %TEMP%\50657287\pve.mp4
- %TEMP%\50657287\ugd.ico
- %TEMP%\50657287\heq.jpg
- %TEMP%\50657287\tew.ppt
- %TEMP%\50657287\etn.xl
- %TEMP%\50657287\rgk.mp3
- %TEMP%\50657287\kpj.icm
- %TEMP%\50657287\wxi.exe
- %TEMP%\50657287\obi=dvf
- %TEMP%\50657287\hge.xl
- %TEMP%\50657287\mtn.pdf
- %TEMP%\50657287\fob.ppt
- %TEMP%\50657287\kue.ico
- %TEMP%\50657287\ncl.dat
- %TEMP%\50657287\bsw.bmp
- %TEMP%\50657287\vgf.ppt
- %TEMP%\50657287\asm.jpg
- %TEMP%\50657287\jtj.docx
- %TEMP%\50657287\dkn.ico
- %TEMP%\50657287\bok.dat
- %TEMP%\50657287\qec.mp4
- %TEMP%\50657287\ojt.bmp
- %TEMP%\50657287\snw.mp3
- %TEMP%\50657287\oqu.txt
- %TEMP%\50657287\smh.ico
- %TEMP%\50657287\boe.pdf
Sets the 'hidden' attribute to the following files:
- %TEMP%\50657287\pve.mp4
- %TEMP%\50657287\psw.bmp
- %TEMP%\50657287\qan.dat
- %TEMP%\50657287\rgk.mp3
- %TEMP%\50657287\qec.mp4
- %TEMP%\50657287\phu.dat
- %TEMP%\50657287\ojt.bmp
- %TEMP%\50657287\oen.docx
- %TEMP%\50657287\ooe.dat
- %TEMP%\50657287\ose.ppt
- %TEMP%\50657287\oqu.txt
- %TEMP%\50657287\rju.ppt
- %TEMP%\50657287\vgf.ppt
- %TEMP%\50657287\ugd.ico
- %TEMP%\50657287\vvr.ico
- %TEMP%\50657287\xjf.xl
- %TEMP%\50657287\wxi.exe
- %TEMP%\50657287\thb.icm
- %TEMP%\50657287\smh.ico
- %TEMP%\50657287\rsj.pdf
- %TEMP%\50657287\snw.mp3
- %TEMP%\50657287\tew.ppt
- %TEMP%\50657287\svq.dat
- %TEMP%\50657287\obi=dvf
- %TEMP%\50657287\etn.xl
- %TEMP%\50657287\emq.ico
- %TEMP%\50657287\fob.ppt
- %TEMP%\50657287\hge.xl
- %TEMP%\50657287\heq.jpg
- %TEMP%\50657287\ehx.txt
- %TEMP%\50657287\boe.pdf
- %TEMP%\50657287\asm.jpg
- %TEMP%\50657287\bok.dat
- %TEMP%\50657287\dkn.ico
- %TEMP%\50657287\bsw.bmp
- %TEMP%\50657287\hsc.icm
- %TEMP%\50657287\mjm.docx
- %TEMP%\50657287\mar.icm
- %TEMP%\50657287\mtn.pdf
- %TEMP%\50657287\ncl.dat
- %TEMP%\50657287\nau.mp4
- %TEMP%\50657287\liq.dat
- %TEMP%\50657287\inh.pdf
- %TEMP%\50657287\iih.bmp
- %TEMP%\50657287\jtj.docx
- %TEMP%\50657287\kue.ico
- %TEMP%\50657287\kpj.icm
Deletes the following files:
- %TEMP%\50657287\EMJGH
Network activity:
Connects to:
- 'wi####d123.ddns.net':5794
UDP:
- DNS ASK wi####d123.ddns.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\50657287\wxi.exe' %TEMP%\50657287\EMJGH
- '%TEMP%\50657287\wxi.exe' obi=dvf
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
