Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Enter' = '%APPDATA%\nnh\pgn.exe %APPDATA%\nnh\mdm-ctd'
Creates or modifies the following files:
- %WINDIR%\system.ini
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe' = '%WINDIR%\M...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
a large number of user processes.
Modifies file system:
Creates the following files:
- %APPDATA%\nnh\xrq.dat
- %APPDATA%\nnh\xpl.pdf
- %APPDATA%\nnh\cue.txt
- %APPDATA%\nnh\pkm.mp4
- %APPDATA%\nnh\tah.mp3
- %APPDATA%\nnh\unp.bmp
- %APPDATA%\nnh\aoh.ppt
- %APPDATA%\nnh\sra.jpg
- %APPDATA%\nnh\sfh.dat
- %APPDATA%\nnh\kxa.docx
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\.Identifier
- %APPDATA%\nnh\spd
- %TEMP%\xmope.exe
- <Full path to file>
- %APPDATA%\nnh\ini
- %APPDATA%\nnh\ges.bmp
- %APPDATA%\nnh\bap.docx
- %APPDATA%\nnh\RDDLE
- %APPDATA%\nnh\ohi.dat
- %APPDATA%\nnh\mdw.ico
- %APPDATA%\nnh\bsu.ppt
- %APPDATA%\nnh\hei.mp3
- %APPDATA%\nnh\qds.ppt
- %APPDATA%\nnh\jin.jpg
- %APPDATA%\nnh\mdm-ctd
- %APPDATA%\nnh\skg.ico
- %APPDATA%\nnh\nih.ppt
- %APPDATA%\nnh\pgn.exe
- %APPDATA%\nnh\ctd.jpg
- %APPDATA%\nnh\vuo.xl
- %APPDATA%\nnh\qcf.mp4
- %APPDATA%\nnh\tdp.mp3
- %APPDATA%\nnh\dou.xl
- %APPDATA%\nnh\qsq.docx
- %APPDATA%\nnh\wsl.ico
- %APPDATA%\nnh\qdp.dat
- %APPDATA%\nnh\bls.dat
- %APPDATA%\nnh\rgh.pdf
Sets the 'hidden' attribute to the following files:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\.Identifier
Deletes the following files:
- %TEMP%\xmope.exe
- %APPDATA%\nnh\RDDLE
Network activity:
Connects to:
- 'so#####cafu.zapto.org':1604
- 'wp#d':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK so#####cafu.zapto.org
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%APPDATA%\nnh\pgn.exe' %APPDATA%\nnh\RDDLE
- '%APPDATA%\nnh\pgn.exe' mdm-ctd
Executes the following:
- '<SYSTEM32>\msdtc.exe'
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe' %APPDATA%\nnh\RDDLE
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe'
