Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinStartYou' = '%ProgramFiles%\WinStartYou\WinStartYou.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ServiceWS] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ServiceWS] 'ImagePath' = '"%WINDIR%\AppService\ServiceWS.exe"'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\WinStartYou\WinStartYOU.exe' = '%ProgramFiles%\WinStart...
Modifies file system:
Creates the following files:
- %CommonProgramFiles%\ME\RepIshWSY.etx
- %ProgramFiles%\WinStartYou\WSYErr.etx
- C:\Documents and Settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
- %WINDIR%\AppService\SerMeERR.etx
- %ProgramFiles%\WinStartYou\1av.etx.tmp
- %ProgramFiles%\WinStartYou\Emgu.CV.dll.tmp
- %ProgramFiles%\WinStartYou\WinSound.dll.tmp
- %ProgramFiles%\WinStartYou\TCPCam.dll.tmp
- %ProgramFiles%\WinStartYou\Ionic.Zip.dll.tmp
- %ProgramFiles%\WinStartYou\Emgu.Util.dll.tmp
- %ProgramFiles%\WinStartYou\WinStartYOU.exe.tmp
- %WINDIR%\WSY.ezi
- %ProgramFiles%\WinStartYou\Var.ezi
- %ProgramFiles%\WinStartYou\Com.ezi
- %ProgramFiles%\WinStartYou\WSY.ezi
- %WINDIR%\AppService\ServiceInfWSY.etx
- %WINDIR%\AppService\RisCmd.etx
- %WINDIR%\AppService\ServiceWS.InstallState
- %WINDIR%\AppService\ServiceWS.InstallLog
- %WINDIR%\AppService\InstallUtil.InstallLog
- %WINDIR%\AppService\InstallaServizio.cmd
- %WINDIR%\SilentCMD.exe
- %WINDIR%\AppService\Interop.IWshRuntimeLibrary.dll
- %WINDIR%\AppService\ServiceWS.exe
- %WINDIR%\AppService\taskschd.dll
- %WINDIR%\AppService\Ionic.Zip.dll
- %WINDIR%\AppService\Interop.TaskScheduler.dll
- <LS_APPDATA>\ME\WSY\InfWSY.ecr
- C:\Documents and Settings\LocalService\Local Settings\Application Data\ME\WSY\DataWSY.ecr
- C:\Documents and Settings\LocalService\Local Settings\Application Data\ME\WinStartYou.exe_Url_rkn0jkgk0xxpj513rczyulu4syldak3t\10.17.4.18\auygwza3.newcfg
Deletes the following files:
- %ProgramFiles%\WinStartYou\WSY.ezi
- %ProgramFiles%\WinStartYou\Com.ezi
- %ProgramFiles%\WinStartYou\Var.ezi
- %ProgramFiles%\WinStartYou\1av.etx
Moves the following files:
- from %ProgramFiles%\WinStartYou\WinStartYOU.exe.tmp to %ProgramFiles%\WinStartYou\WinStartYOU.exe
- from %ProgramFiles%\WinStartYou\Emgu.Util.dll.tmp to %ProgramFiles%\WinStartYou\Emgu.Util.dll
- from %ProgramFiles%\WinStartYou\Ionic.Zip.dll.tmp to %ProgramFiles%\WinStartYou\Ionic.Zip.dll
- from %ProgramFiles%\WinStartYou\TCPCam.dll.tmp to %ProgramFiles%\WinStartYou\TCPCam.dll
- from %ProgramFiles%\WinStartYou\WinSound.dll.tmp to %ProgramFiles%\WinStartYou\WinSound.dll
- from %ProgramFiles%\WinStartYou\Emgu.CV.dll.tmp to %ProgramFiles%\WinStartYou\Emgu.CV.dll
- from %ProgramFiles%\WinStartYou\1av.etx.tmp to %ProgramFiles%\WinStartYou\1av.etx
- from C:\Documents and Settings\LocalService\Local Settings\Application Data\ME\WinStartYou.exe_Url_rkn0jkgk0xxpj513rczyulu4syldak3t\10.17.4.18\auygwza3.newcfg to C:\Documents and Settings\LocalService\Local Settings\Application Data\ME\WinStartYou.exe_Url_rkn0jkgk0xxpj513rczyulu4syldak3t\10.17.4.18\user.config
Network activity:
Connects to:
- 're####n76.no-ip.org':8977
- 'localhost':8977
UDP:
- DNS ASK re####n76.no-ip.org
Miscellaneous:
Creates and executes the following:
- '%WINDIR%\AppService\ServiceWS.exe'
- '%ProgramFiles%\WinStartYou\WinStartYOU.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\AppService\InstallaServizio.cmd" "
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe' ServiceWS.exe
- '<SYSTEM32>\sc.exe' Start ServiceWS
