Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\.VCR\shell\open\command] '' = 'C:\Interwise\Student\student.exe %1'
- [<HKLM>\SOFTWARE\Classes\VCR File\shell\open\command] '' = 'C:\Interwise\Student\student.exe %1'
- [<HKLM>\SYSTEM\ControlSet001\Control\Print\Monitors\Fax & Color print Port] 'Driver' = 'imgcl6mn.dll'
- [<HKLM>\SOFTWARE\Classes\VCM File\shell\open\command] '' = 'C:\Interwise\Student\student.exe %1'
- [<HKLM>\SOFTWARE\Classes\.SVC\shell\open\command] '' = 'C:\Interwise\Student\student.exe %1'
- [<HKLM>\SOFTWARE\Classes\SVC File\shell\open\command] '' = 'C:\Interwise\Student\student.exe %1'
- [<HKLM>\SOFTWARE\Classes\.VCM\shell\open\command] '' = 'C:\Interwise\Student\student.exe %1'
Malicious functions:
Injects code into
the following system processes:
Modifies file system:
Creates the following files:
- <SYSTEM32>\IMGCL6MN.DLL
- <SYSTEM32>\IMGCL6MU.DLL
- <SYSTEM32>\IMG32JPM.DLL
- %TEMP%\install.log
- C:\Interwise\Student\ImageMaker\~GLH0034.TMP
- C:\Interwise\Student\ImageMaker\~GLH0035.TMP
- C:\Interwise\Student\ImageMaker\~GLH0036.TMP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- <SYSTEM32>\spool\drivers\w32x86\IMGFAX.HLP
- <SYSTEM32>\spool\drivers\w32x86\IMGCL6DR.DLL
- <SYSTEM32>\spool\drivers\w32x86\IMGCL6UI.DLL
- C:\Interwise\Student\ImageMaker\~GLH0033.TMP
- C:\Interwise\Student\ImageMaker\~GLH0029.TMP
- C:\Interwise\Student\ImageMaker\~GLH002a.TMP
- C:\Interwise\Student\ImageMaker\~GLH002b.TMP
- C:\Interwise\Student\ImageMaker\~GLH0028.TMP
- %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0025.TMP
- %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0026.TMP
- C:\Interwise\Student\~GLH0027.TMP
- C:\Interwise\Student\ImageMaker\~GLH0030.TMP
- C:\Interwise\Student\ImageMaker\~GLH0031.TMP
- C:\Interwise\Student\ImageMaker\~GLH0032.TMP
- C:\Interwise\Student\ImageMaker\~GLH002f.TMP
- C:\Interwise\Student\ImageMaker\~GLH002c.TMP
- C:\Interwise\Student\ImageMaker\~GLH002d.TMP
- C:\Interwise\Student\ImageMaker\~GLH002e.TMP
- <SYSTEM32>\spool\drivers\w32x86\2\New\Imgfax.hlp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\Interwise\Student\ImageMaker\install.log
- <SYSTEM32>\spool\drivers\w32x86\2\New\imgcl6ui.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- <SYSTEM32>\spool\drivers\w32x86\2\New\imgcl6dr.dll
- C:\Interwise\Student\Participant.CNT
- C:\Interwise\Student\AppShare.wmf
- C:\Interwise\Student\AppShareFrz.WMF
- C:\Interwise\Student\PARTICIPANT.HLP
- %TEMP%\winstfax.log
- C:\Interwise\Student\ImageMaker\winstfax.log
- C:\Interwise\Student\~GLH0037.TMP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0024.TMP
- %TEMP%\GLK3.tmp
- %TEMP%\GLM4.tmp
- %TEMP%\GLG6.tmp
- %TEMP%\GLJ2.tmp
- %TEMP%\RarSFX0\lang_dll.exe
- %TEMP%\RarSFX0\Setup.exe
- %TEMP%\GLC1.tmp
- C:\Interwise\Student\~GLH0004.TMP
- C:\Interwise\Student\~GLH0005.TMP
- C:\Interwise\Student\~GLH0006.TMP
- C:\Interwise\Student\~GLH0003.TMP
- %TEMP%\~GLH0000.TMP
- C:\Interwise\Student\~GLH0001.TMP
- C:\Interwise\Student\~GLH0002.TMP
- %TEMP%\RarSFX0\version.ini
- %TEMP%\RarSFX0\IM-REG.txt
- %TEMP%\RarSFX0\lang.txt
- %TEMP%\RarSFX0\license.txt
- %TEMP%\RarSFX0\FileList.txt
- %TEMP%\RarSFX0\Association.txt
- %TEMP%\RarSFX0\C-REG.TXT
- %TEMP%\RarSFX0\DIAL.TXT
- %TEMP%\RarSFX0\StringTable.txt
- %TEMP%\RarSFX0\LANG.INI
- %TEMP%\RarSFX0\STUDENT.INI
- %TEMP%\RarSFX0\setupReg.txt
- %TEMP%\RarSFX0\Netscape.txt
- %TEMP%\RarSFX0\OpViewr.TXT
- %TEMP%\RarSFX0\push.TXT
- %CommonProgramFiles%\OpSession\Shared\~GLH001a.TMP
- %CommonProgramFiles%\OpSession\Shared\~GLH001b.TMP
- %CommonProgramFiles%\OpSession\Shared\~GLH001c.TMP
- C:\Interwise\Student\~GLH0019.TMP
- C:\Interwise\Student\Sound\~GLH0016.TMP
- C:\Interwise\Student\Sound\~GLH0017.TMP
- C:\Interwise\Student\~GLH0018.TMP
- %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0021.TMP
- %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0022.TMP
- %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0023.TMP
- %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0020.TMP
- %CommonProgramFiles%\OpSession\Shared\~GLH001d.TMP
- %CommonProgramFiles%\OpSession\Viewer Shared\~GLH001e.TMP
- %CommonProgramFiles%\OpSession\Viewer Shared\~GLH001f.TMP
- C:\Interwise\Student\Sound\~GLH0015.TMP
- C:\Interwise\Student\~GLH000b.TMP
- C:\Interwise\Student\~GLH000c.TMP
- C:\Interwise\Student\~GLH000d.TMP
- C:\Interwise\Student\~GLH000a.TMP
- C:\Interwise\Student\~GLH0007.TMP
- C:\Interwise\Student\~GLH0008.TMP
- C:\Interwise\Student\~GLH0009.TMP
- C:\Interwise\Student\~GLH0012.TMP
- C:\Interwise\Student\Sound\~GLH0013.TMP
- C:\Interwise\Student\Sound\~GLH0014.TMP
- C:\Interwise\Student\~GLH0011.TMP
- C:\Interwise\Student\~GLH000e.TMP
- C:\Interwise\Student\~GLH000f.TMP
- C:\Interwise\Student\~GLH0010.TMP
Deletes the following files:
- %TEMP%\winstfax.log
- C:\Interwise\Student\RegSecDll.dll
- C:\Interwise\Student\pgrs_tmp.txt
- %TEMP%\install.log
Moves the following files:
- from C:\Interwise\Student\ImageMaker\~GLH0029.TMP to C:\Interwise\Student\ImageMaker\img32mfx.dll
- from C:\Interwise\Student\ImageMaker\~GLH0028.TMP to C:\Interwise\Student\ImageMaker\IMG32JPS.DLL
- from C:\Interwise\Student\~GLH0027.TMP to C:\Interwise\Student\vc_opsession.dll
- from C:\Interwise\Student\ImageMaker\~GLH002c.TMP to C:\Interwise\Student\ImageMaker\PrCtrl32.exe
- from C:\Interwise\Student\ImageMaker\~GLH002b.TMP to C:\Interwise\Student\ImageMaker\ImgReduc.exe
- from C:\Interwise\Student\ImageMaker\~GLH002a.TMP to C:\Interwise\Student\ImageMaker\imginstl.dll
- from %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0026.TMP to %CommonProgramFiles%\OpSession\Viewer Shared\viewrEUS.dll
- from %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0022.TMP to %CommonProgramFiles%\OpSession\Viewer Shared\vc_Commn.dll
- from %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0021.TMP to %CommonProgramFiles%\OpSession\Viewer Shared\vc_Comm.dll
- from %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0020.TMP to %CommonProgramFiles%\OpSession\Viewer Shared\vcui_pwd.dll
- from %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0025.TMP to %CommonProgramFiles%\OpSession\Viewer Shared\viewr.dll
- from %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0024.TMP to %CommonProgramFiles%\OpSession\Viewer Shared\vc_proto.dll
- from %CommonProgramFiles%\OpSession\Viewer Shared\~GLH0023.TMP to %CommonProgramFiles%\OpSession\Viewer Shared\vc_ingrd.dll
- from C:\Interwise\Student\ImageMaker\~GLH002d.TMP to C:\Interwise\Student\ImageMaker\SETUP.INI
- from <SYSTEM32>\spool\drivers\w32x86\2\New\imgcl6dr.dll to <SYSTEM32>\spool\drivers\w32x86\2\imgcl6dr.dll
- from C:\Interwise\Student\ImageMaker\~GLH0036.TMP to C:\Interwise\Student\ImageMaker\imgcl6ui.dll
- from C:\Interwise\Student\ImageMaker\~GLH0035.TMP to C:\Interwise\Student\ImageMaker\imgcl6mu.dll
- from C:\Interwise\Student\~GLH0037.TMP to C:\Interwise\Student\RegSecDll.dll
- from <SYSTEM32>\spool\drivers\w32x86\2\New\Imgfax.hlp to <SYSTEM32>\spool\drivers\w32x86\2\Imgfax.hlp
- from <SYSTEM32>\spool\drivers\w32x86\2\New\imgcl6ui.dll to <SYSTEM32>\spool\drivers\w32x86\2\imgcl6ui.dll
- from C:\Interwise\Student\ImageMaker\~GLH0034.TMP to C:\Interwise\Student\ImageMaker\imgcl6mn.dll
- from C:\Interwise\Student\ImageMaker\~GLH0030.TMP to C:\Interwise\Student\ImageMaker\ODCAXD.OCX
- from C:\Interwise\Student\ImageMaker\~GLH002f.TMP to C:\Interwise\Student\ImageMaker\ImgCom.dll
- from C:\Interwise\Student\ImageMaker\~GLH002e.TMP to C:\Interwise\Student\ImageMaker\winstfax.exe
- from C:\Interwise\Student\ImageMaker\~GLH0033.TMP to C:\Interwise\Student\ImageMaker\imgcl6dr.dll
- from C:\Interwise\Student\ImageMaker\~GLH0032.TMP to C:\Interwise\Student\ImageMaker\IMGFAX.HLP
- from C:\Interwise\Student\ImageMaker\~GLH0031.TMP to C:\Interwise\Student\ImageMaker\img32jpm.dll
- from C:\Interwise\Student\~GLH000d.TMP to C:\Interwise\Student\comcenter.exe
- from C:\Interwise\Student\~GLH000c.TMP to C:\Interwise\Student\ashk.dll
- from C:\Interwise\Student\~GLH000b.TMP to C:\Interwise\Student\UNRAR.DLL
- from C:\Interwise\Student\~GLH0010.TMP to C:\Interwise\Student\pxauth.dll
- from C:\Interwise\Student\~GLH000f.TMP to C:\Interwise\Student\pull.exe
- from C:\Interwise\Student\~GLH000e.TMP to C:\Interwise\Student\IwReg.dll
- from C:\Interwise\Student\~GLH000a.TMP to C:\Interwise\Student\PptDll.dll
- from C:\Interwise\Student\~GLH0006.TMP to C:\Interwise\Student\Kill.exe
- from C:\Interwise\Student\~GLH0001.TMP to C:\Interwise\Student\pgrs_tmp.txt
- from %TEMP%\~GLH0000.TMP to %TEMP%\GLF7.tmp
- from C:\Interwise\Student\~GLH0009.TMP to C:\Interwise\Student\netsdll.dll
- from C:\Interwise\Student\~GLH0008.TMP to C:\Interwise\Student\eclvr.dll
- from C:\Interwise\Student\~GLH0007.TMP to C:\Interwise\Student\iwuninst.exe
- from C:\Interwise\Student\~GLH0011.TMP to C:\Interwise\Student\STUDENT.EXE
- from %CommonProgramFiles%\OpSession\Shared\~GLH001c.TMP to %CommonProgramFiles%\OpSession\Shared\ECL_sock.dll
- from %CommonProgramFiles%\OpSession\Shared\~GLH001b.TMP to %CommonProgramFiles%\OpSession\Shared\ECL_http.dll
- from %CommonProgramFiles%\OpSession\Shared\~GLH001a.TMP to %CommonProgramFiles%\OpSession\Shared\ECL_dflt.dll
- from %CommonProgramFiles%\OpSession\Viewer Shared\~GLH001f.TMP to %CommonProgramFiles%\OpSession\Viewer Shared\vcui_msg.dll
- from %CommonProgramFiles%\OpSession\Viewer Shared\~GLH001e.TMP to %CommonProgramFiles%\OpSession\Viewer Shared\vcui_cht.dll
- from %CommonProgramFiles%\OpSession\Shared\~GLH001d.TMP to %CommonProgramFiles%\OpSession\Shared\EMCL_Dfl.dll
- from C:\Interwise\Student\~GLH0018.TMP to C:\Interwise\Student\InstallDetect.ocx
- from C:\Interwise\Student\Sound\~GLH0014.TMP to C:\Interwise\Student\Sound\QUESTION.WAV
- from C:\Interwise\Student\Sound\~GLH0013.TMP to C:\Interwise\Student\Sound\CONVMODE.WAV
- from C:\Interwise\Student\~GLH0012.TMP to C:\Interwise\Student\StudSetup.exe
- from C:\Interwise\Student\Sound\~GLH0017.TMP to C:\Interwise\Student\Sound\TEACHRIN.WAV
- from C:\Interwise\Student\Sound\~GLH0016.TMP to C:\Interwise\Student\Sound\SOUNDREFENG.WAV
- from C:\Interwise\Student\Sound\~GLH0015.TMP to C:\Interwise\Student\Sound\SOUNDREF.WAV
Substitutes the following files:
- C:\Interwise\Student\pgrs_tmp.txt
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- 'C:\Interwise\Student\Kill.exe' /f comcenter.exe
- 'C:\Interwise\Student\ImageMaker\winstfax.exe' "C:\Interwise\Student\ImageMaker" "ImageMaker Color Driver" "C:\Interwise\Student\ImageMaker" "C:\Interwise\Student\ImageMaker\PrCtrl32.exe" FAXPORT
- '%TEMP%\RarSFX0\lang_dll.exe'
- 'C:\Interwise\Student\Kill.exe' /f StudSetup.exe
- '%TEMP%\RarSFX0\Setup.exe'
- 'C:\Interwise\Student\Kill.exe' /f student.exe
- 'C:\Interwise\Student\Kill.exe' /f pull.exe
