Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\ShowMyPC\-<File name>\tvnserver.exe' = '%TEMP%\ShowMyPC\-<File ...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\ShowMyPC\-<File name>\SMPCSetup.exe' = '%TEMP%\ShowMyPC\-<File ...
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\ShowMyPC\-<File name>\tvnserver.exe" "ShowMyPCtvnservertemp" ENABLE
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="ShowMyPCtvnservertemp" dir=in action=allow program="%TEMP%\ShowMyPC\-<File name>\tvnserver.exe" enable=yes
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\ShowMyPC\-<File name>\SMPCSetup.exe" "ShowMyPCAuto" ENABLE
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="ShowMyPCAuto" dir=in action=allow program="%TEMP%\ShowMyPC\-<File name>\SMPCSetup.exe" enable=yes
Modifies file system:
Creates the following files:
- %TEMP%\ShowMyPC\-<File name>\DiffieHellman.dll
- %TEMP%\ShowMyPC\-<File name>\Org.Mentalis.Security.dll
- %TEMP%\ShowMyPC\-<File name>\XDMessaging.dll
- %TEMP%\ShowMyPC\-<File name>\wodVPN.dll
- %TEMP%\ShowMyPC\-<File name>\wodVPN.dll.manifest
- %TEMP%\ShowMyPC\-<File name>\Interop.WODVPNCOMLib.dll
- %TEMP%\ShowMyPC\-<File name>\loading.html
- %HOMEPATH%\Desktop\ShowMyPC.lnk
- %TEMP%\Cab4.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\about-us1[1].html
- %TEMP%\ShowMyPC\-<File name>\spcplink.exe
- %TEMP%\ShowMyPC\-<File name>\smpcview.exe
- %TEMP%\ShowMyPC\-<File name>\smpcview.exe.config
- %TEMP%\ShowMyPC\-<File name>\screenhooks.dll
- %TEMP%\ShowMyPC\-<File name>\smpcvc.exe
- %TEMP%\ShowMyPC\-<File name>\settings.ini
- %TEMP%\ShowMyPC\-<File name>\SMPCSetup.exe
- %TEMP%\nsq2.tmp
- %TEMP%\nsk3.tmp\md5dll.dll
- %TEMP%\nsk3.tmp\System.dll
- %TEMP%\ShowMyPC\-<File name>\SMPCSetup.exe.config
- %TEMP%\ShowMyPC\-<File name>\mm2.res
- %TEMP%\ShowMyPC\-<File name>\smwg.exe
- %TEMP%\ShowMyPC\-<File name>\sas.dll
- %TEMP%\ShowMyPC\-<File name>\SMPCSetup.exe.manifest
- %TEMP%\ShowMyPC\-<File name>\smvnview.exe
- %TEMP%\ShowMyPC\-<File name>\tvnserver.exe
Deletes the following files:
- %TEMP%\Cab4.tmp
- %TEMP%\nsk3.tmp\System.dll
- %TEMP%\nsk3.tmp\md5dll.dll
Network activity:
Connects to:
- 'localhost':1041
- 'sh###ypc.com':443
- 'sh###ypc.com':80
- 'wp#d':80
- 'cr#.##modoca.com':80
- 'download.windowsupdate.com':80
TCP:
HTTP GET requests:
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com
- http://sh###ypc.com/app/about-us1.html?pv#####
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
- http://11#.#11.111.1/wpad.dat via wp#d
- http://cr#.##modoca.com/COMODORSACodeSigningCA.crt
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK sh###ypc.com
- DNS ASK wp#d
- DNS ASK cr#.##modoca.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
Creates and executes the following:
- '%TEMP%\ShowMyPC\-<File name>\SMPCSetup.exe'
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall delete allowedprogram "%TEMP%\ShowMyPC\-<File name>\tvnserver.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="ShowMyPCtvnservertemp" program="%TEMP%\ShowMyPC\-<File name>\tvnserver.exe"
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="ShowMyPCAuto" program="%TEMP%\ShowMyPC\-<File name>\SMPCSetup.exe"
- '<SYSTEM32>\regsvr32.exe' "%TEMP%\ShowMyPC\-<File name>\wodVPN.dll" /s
- '<SYSTEM32>\netsh.exe' firewall delete allowedprogram "%TEMP%\ShowMyPC\-<File name>\SMPCSetup.exe"
