Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wim' = '%TEMP%\37914931\aip.exe %TEMP%\37914931\lks=kqi'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\RcDfr3rEZXNf.lnk
Creates the following files on removable media:
- <Drive name for removable media>:\rummy.exe
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' = '%WINDIR%\Mi...
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "RegAsm.exe" ENABLE
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
the following user processes:
- RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\37914931\fpm.txt
- %TEMP%\37914931\qkh.ppt
- %TEMP%\37914931\pfx.mp3
- %TEMP%\37914931\utq.txt
- %TEMP%\37914931\usb.jpg
- %TEMP%\37914931\tig.bmp
- %TEMP%\37914931\vnt.ppt
- %TEMP%\37914931\exe.xl
- %TEMP%\37914931\cms.pdf
- %TEMP%\37914931\kpx.txt
- %TEMP%\37914931\sgo.txt
- %TEMP%\37914931\mbe.mp3
- %TEMP%\37914931\whc.ppt
- %TEMP%\37914931\QRRXY
- %TEMP%\37914931\ame.mp3
- %TEMP%\37914931\feh.mp3
- %APPDATA%\hVszyYEKe\6730.xml
- %TEMP%\37914931\spd
- %TEMP%\RegSvcs.exe
- %TEMP%\37914931\nko.docx
- %TEMP%\37914931\hji.icm
- %TEMP%\37914931\ses.icm
- %TEMP%\37914931\ipl.docx
- %TEMP%\37914931\uki.bmp
- %TEMP%\37914931\qcn.icm
- %TEMP%\37914931\obr.bmp
- %TEMP%\37914931\wbk.mp3
- %TEMP%\37914931\mrm.icm
- %TEMP%\37914931\kuo.mp4
- %TEMP%\37914931\wiq.mp4
- %TEMP%\37914931\oin.txt
- %TEMP%\37914931\cun.ico
- %TEMP%\37914931\abm.icm
- %TEMP%\37914931\nju.mp3
- %TEMP%\37914931\aip.exe
- %TEMP%\37914931\lks=kqi
- %TEMP%\37914931\pon.mp4
- %TEMP%\37914931\wop.dat
- %TEMP%\37914931\fok.dat
- %TEMP%\37914931\sxu.pdf
- %TEMP%\37914931\pab.ico
- %TEMP%\37914931\aou.pdf
- %TEMP%\37914931\qxq.xl
- %TEMP%\37914931\kkr.jpg
- %TEMP%\37914931\khk.jpg
- %TEMP%\37914931\paq.docx
- %TEMP%\37914931\rab.txt
- %TEMP%\37914931\qqo.pdf
- %TEMP%\37914931\nop.txt
- %TEMP%\37914931\cuk.mp3
- %TEMP%\37914931\dmb.mp4
- %TEMP%\37914931\vnp.pdf
- %TEMP%\37914931\elt.dat
Sets the 'hidden' attribute to the following files:
- %TEMP%\37914931\qqo.pdf
- %TEMP%\37914931\qkh.ppt
- %TEMP%\37914931\qcn.icm
- %TEMP%\37914931\ses.icm
- %TEMP%\37914931\rab.txt
- %TEMP%\37914931\qxq.xl
- %TEMP%\37914931\pab.ico
- %TEMP%\37914931\oin.txt
- %TEMP%\37914931\obr.bmp
- %TEMP%\37914931\pon.mp4
- %TEMP%\37914931\pfx.mp3
- %TEMP%\37914931\paq.docx
- %TEMP%\37914931\sgo.txt
- %TEMP%\37914931\whc.ppt
- %TEMP%\37914931\wbk.mp3
- %TEMP%\37914931\vnt.ppt
- <Drive name for removable media>:\rummy.exe
- %TEMP%\37914931\wop.dat
- %TEMP%\37914931\wiq.mp4
- %TEMP%\37914931\uki.bmp
- %TEMP%\37914931\tig.bmp
- %TEMP%\37914931\sxu.pdf
- %TEMP%\37914931\vnp.pdf
- %TEMP%\37914931\utq.txt
- %TEMP%\37914931\usb.jpg
- %TEMP%\37914931\elt.dat
- %TEMP%\37914931\dmb.mp4
- %TEMP%\37914931\cun.ico
- %TEMP%\37914931\fok.dat
- %TEMP%\37914931\feh.mp3
- %TEMP%\37914931\exe.xl
- %TEMP%\37914931\ame.mp3
- %TEMP%\37914931\aip.exe
- %TEMP%\37914931\abm.icm
- %TEMP%\37914931\cuk.mp3
- %TEMP%\37914931\cms.pdf
- %TEMP%\37914931\aou.pdf
- %TEMP%\37914931\fpm.txt
- %TEMP%\37914931\mrm.icm
- %TEMP%\37914931\mbe.mp3
- %TEMP%\37914931\lks=kqi
- %TEMP%\37914931\nop.txt
- %TEMP%\37914931\nko.docx
- %TEMP%\37914931\nju.mp3
- %TEMP%\37914931\khk.jpg
- %TEMP%\37914931\ipl.docx
- %TEMP%\37914931\hji.icm
- %TEMP%\37914931\kuo.mp4
- %TEMP%\37914931\kpx.txt
- %TEMP%\37914931\kkr.jpg
Deletes the following files:
- %TEMP%\37914931\QRRXY
- %TEMP%\RegSvcs.exe
Moves the following files:
- from %APPDATA%\hVszyYEKe\6730.xml to %APPDATA%\hVszyYEKe\ZSFXjOUP.exe
Network activity:
Connects to:
- 'so#####n2000.no-ip.info':1004
UDP:
- DNS ASK so#####n2000.no-ip.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\RegSvcs.exe'
- '%TEMP%\37914931\aip.exe' %TEMP%\37914931\QRRXY
- '%TEMP%\37914931\aip.exe' lks=kqi
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
