Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\usbhubsvc4] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\usbhubsvc4] 'ImagePath' = '<SYSTEM32>\svchost.exe -k "MsHubSvc4" -svcr "SkypeC0SvcService.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\usbhubsvc4\Parameters] 'ServiceDLL' = '%APPDATA%\LocalDataNT\msimg32.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\teamviewervpn] 'ImagePath' = 'system32\DRIVERS\teamviewervpn.sys'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- %TEMP%\nsa2.tmp
- %APPDATA%\Cab1A.tmp
- %APPDATA%\Cab1C.tmp
- %APPDATA%\Cab1E.tmp
- %APPDATA%\Cab20.tmp
- %APPDATA%\Cab22.tmp
- %APPDATA%\Cab24.tmp
- %APPDATA%\Cab26.tmp
- %APPDATA%\Cab28.tmp
- %APPDATA%\Cab2A.tmp
- %APPDATA%\Cab2C.tmp
- %APPDATA%\Cab2E.tmp
- %APPDATA%\Cab30.tmp
- %APPDATA%\LocalDataNT\tv.ini
- %APPDATA%\Cab32.tmp
- %APPDATA%\Cab36.tmp
- %APPDATA%\Cab38.tmp
- %APPDATA%\Cab3A.tmp
- %APPDATA%\Cab3C.tmp
- %APPDATA%\Cab3E.tmp
- %APPDATA%\Cab40.tmp
- %APPDATA%\Cab42.tmp
- %APPDATA%\Cab44.tmp
- %APPDATA%\Cab46.tmp
- %APPDATA%\Cab48.tmp
- %APPDATA%\Cab4A.tmp
- %APPDATA%\Cab4C.tmp
- %APPDATA%\Cab16.tmp
- %APPDATA%\Cab18.tmp
- %APPDATA%\Cab14.tmp
- %APPDATA%\Cab12.tmp
- %APPDATA%\Cab10.tmp
- %APPDATA%\LocalDataNT\TeamViewer_Desktop.exe
- %APPDATA%\LocalDataNT\TeamViewer_Resource_en.dll
- %APPDATA%\LocalDataNT\TeamViewer_StaticRes.dll
- %APPDATA%\LocalDataNT\msimg32.dll
- %APPDATA%\LocalDataNT\tv_w32.dll
- %APPDATA%\LocalDataNT\tv_w32.exe
- %APPDATA%\LocalDataNT\tv_x64.dll
- %APPDATA%\LocalDataNT\tv_x64.exe
- %APPDATA%\LocalDataNT\tvr.cfg
- %APPDATA%\LocalDataNT\vnc.tvrp
- %APPDATA%\LocalDataNT\vpn64.cab
- %APPDATA%\LocalDataNT\vpn86.cab
- %APPDATA%\Cab4E.tmp
- %APPDATA%\Cab34.tmp
- %APPDATA%\LocalDataNT\TeamViewer.ini
- %APPDATA%\LocalDataNT\teamviewervpn.inf
- %APPDATA%\LocalDataNT\teamviewervpn.sys
- %APPDATA%\LocalDataNT\svpn.exe
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- <DRIVERS>\SET5.tmp
- %APPDATA%\Cab6.tmp
- %APPDATA%\Cab8.tmp
- %APPDATA%\CabA.tmp
- %APPDATA%\CabC.tmp
- %APPDATA%\CabE.tmp
- %APPDATA%\LocalDataNT\SkypeC0SvcService.exe
- %APPDATA%\LocalDataNT\teamviewervpn.cat
- %APPDATA%\Cab50.tmp
Sets the 'hidden' attribute to the following files:
- %APPDATA%\LocalDataNT\TeamViewer_StaticRes.dll
- %APPDATA%\LocalDataNT\teamviewervpn.inf
- %APPDATA%\LocalDataNT\teamviewervpn.cat
- %APPDATA%\LocalDataNT\teamviewervpn.sys
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %APPDATA%\LocalDataNT\SkypeC0SvcService.exe
- %APPDATA%\LocalDataNT\tvr.cfg
- %APPDATA%\LocalDataNT\msimg32.dll
- %APPDATA%\LocalDataNT\tv.ini
- %APPDATA%\LocalDataNT\TeamViewer.ini
- %APPDATA%\LocalDataNT\vpn64.cab
- %APPDATA%\LocalDataNT\vpn86.cab
- %APPDATA%\LocalDataNT\tv_x64.dll
- %APPDATA%\LocalDataNT\tv_w32.dll
- %APPDATA%\LocalDataNT\tv_x64.exe
- %APPDATA%\LocalDataNT\tv_w32.exe
- %APPDATA%\LocalDataNT\TeamViewer_Desktop.exe
- %APPDATA%\LocalDataNT\TeamViewer_Resource_en.dll
- %APPDATA%\LocalDataNT\svpn.exe
- %APPDATA%\LocalDataNT\vnc.tvrp
Deletes the following files:
- %APPDATA%\LocalDataNT\teamviewervpn.sys
- %APPDATA%\Cab2C.tmp
- %APPDATA%\Cab2E.tmp
- %APPDATA%\Cab30.tmp
- %APPDATA%\Cab32.tmp
- %APPDATA%\Cab34.tmp
- %APPDATA%\Cab36.tmp
- %APPDATA%\Cab38.tmp
- %APPDATA%\Cab3A.tmp
- %APPDATA%\Cab3C.tmp
- %APPDATA%\Cab3E.tmp
- %APPDATA%\Cab40.tmp
- %APPDATA%\Cab42.tmp
- %APPDATA%\Cab44.tmp
- %APPDATA%\Cab46.tmp
- %APPDATA%\Cab48.tmp
- %APPDATA%\Cab4A.tmp
- %APPDATA%\Cab4C.tmp
- %APPDATA%\Cab2A.tmp
- %APPDATA%\Cab4E.tmp
- %APPDATA%\Cab28.tmp
- %APPDATA%\Cab24.tmp
- %APPDATA%\LocalDataNT\teamviewervpn.cat
- %APPDATA%\LocalDataNT\teamviewervpn.inf
- %APPDATA%\Cab6.tmp
- %APPDATA%\Cab8.tmp
- %APPDATA%\CabA.tmp
- %APPDATA%\CabC.tmp
- %APPDATA%\CabE.tmp
- %APPDATA%\Cab10.tmp
- %APPDATA%\Cab12.tmp
- %APPDATA%\Cab14.tmp
- %APPDATA%\Cab16.tmp
- %APPDATA%\Cab18.tmp
- %APPDATA%\Cab1A.tmp
- %APPDATA%\Cab1C.tmp
- %APPDATA%\Cab1E.tmp
- %APPDATA%\Cab20.tmp
- %APPDATA%\Cab22.tmp
- %APPDATA%\Cab26.tmp
- %APPDATA%\Cab50.tmp
Moves the following files:
- from <DRIVERS>\SET5.tmp to <DRIVERS>\teamviewervpn.sys
Network activity:
Connects to:
- '95.##2.30.10':443
- 'wp#d':80
- 'download.windowsupdate.com':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com
UDP:
- DNS ASK wp#d
- DNS ASK www.download.windowsupdate.com
Miscellaneous:
Creates and executes the following:
- '%APPDATA%\LocalDataNT\SkypeC0SvcService.exe'
- '%APPDATA%\LocalDataNT\svpn.exe' install "%APPDATA%\LocalDataNT\TeamViewerVPN.inf" teamviewervpn
- '%APPDATA%\LocalDataNT\svpn.exe' restart teamviewervpn
Executes the following:
- '<SYSTEM32>\svchost.exe' -k "MsHubSvc4" -svcr "SkypeC0SvcService.exe"
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\svchost.exe' -k -svcr "%APPDATA%\LocalDataNT\vnc.tvrp"
- '<SYSTEM32>\svchost.exe' -k
