Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'WinPrint' = '"%APPDATA%\LocalDataNT\WinPrint.exe" r "WinPrintSvc.exe"'
Modifies file system:
Creates the following files:
- %TEMP%\NS-PE5FT.tmp\NS-PS5P7.tmp
- %APPDATA%\LocalDataNT\Password.rcfg
- %APPDATA%\LocalDataNT\notification.rcfg
- %APPDATA%\LocalDataNT\winspool.drv
- %APPDATA%\LocalDataNT\WinPrintSvc.exe
- %APPDATA%\LocalDataNT\WinPrint.exe
- %APPDATA%\LocalDataNT\vp8encoder.dll
- %APPDATA%\LocalDataNT\updatecache.bat
- %APPDATA%\LocalDataNT\InternetId.rcfg
- %APPDATA%\LocalDataNT\pp.pdf
- %TEMP%\NS-P0J7V.tmp\UPD\NS-4NJ9K.tmp
- %TEMP%\NS-P0J7V.tmp\UPD\NS-UOLGC.tmp
- %TEMP%\NS-P0J7V.tmp\UPD\NS-GF27P.tmp
- %TEMP%\NS-P0J7V.tmp\UPD\NS-EOIEA.tmp
- %TEMP%\NS-P0J7V.tmp\UPD\NS-ABF4F.tmp
- %TEMP%\NS-P0J7V.tmp\_iscrypt.dll
- %TEMP%\NS-P0J7V.tmp\_shfoldr.dll
- %TEMP%\NS-P0J7V.tmp\UPD\NS-AJ3F4.tmp
- %APPDATA%\LocalDataNT\Options.rcfg
Deletes the following files:
- %TEMP%\NS-P0J7V.tmp\UPD\pp.pdf
- %TEMP%\NS-P0J7V.tmp\UPD\updatecache.bat
- %TEMP%\NS-P0J7V.tmp\UPD\vp8encoder.dll
- %TEMP%\NS-P0J7V.tmp\UPD\WinPrint.exe
- %TEMP%\NS-P0J7V.tmp\UPD\WinPrintSvc.exe
- %TEMP%\NS-P0J7V.tmp\UPD\winspool.drv
- %TEMP%\NS-P0J7V.tmp\_iscrypt.dll
- %TEMP%\NS-P0J7V.tmp\_shfoldr.dll
- %TEMP%\NS-PE5FT.tmp\NS-PS5P7.tmp
Moves the following files:
- from %TEMP%\NS-P0J7V.tmp\UPD\NS-ABF4F.tmp to %TEMP%\NS-P0J7V.tmp\UPD\updatecache.bat
- from %TEMP%\NS-P0J7V.tmp\UPD\NS-EOIEA.tmp to %TEMP%\NS-P0J7V.tmp\UPD\vp8encoder.dll
- from %TEMP%\NS-P0J7V.tmp\UPD\NS-GF27P.tmp to %TEMP%\NS-P0J7V.tmp\UPD\WinPrint.exe
- from %TEMP%\NS-P0J7V.tmp\UPD\NS-UOLGC.tmp to %TEMP%\NS-P0J7V.tmp\UPD\WinPrintSvc.exe
- from %TEMP%\NS-P0J7V.tmp\UPD\NS-4NJ9K.tmp to %TEMP%\NS-P0J7V.tmp\UPD\winspool.drv
- from %TEMP%\NS-P0J7V.tmp\UPD\NS-AJ3F4.tmp to %TEMP%\NS-P0J7V.tmp\UPD\pp.pdf
Network activity:
Connects to:
- 'localhost':5640
- 'se####.#emoteutilities.com':80
- 'id.####teutilities.com':5655
- 'id.####teutilities.com':443
TCP:
HTTP GET requests:
- http://se####.#emoteutilities.com/utils/inet_id_notify.php?te####
UDP:
- DNS ASK se####.#emoteutilities.com
- DNS ASK id.####teutilities.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\NS-PE5FT.tmp\NS-PS5P7.tmp' /SL4 $40036 <Full path to file> 4121391 332288 /password=Bindown /verysilent
- '%APPDATA%\LocalDataNT\WinPrint.exe' r "WinPrintSvc.exe"
- '%APPDATA%\LocalDataNT\WinPrintSvc.exe' a "WinPrint.exe"
Executes the following:
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\NS-P0J7V.tmp\UPD\updatecache.bat""
- '<SYSTEM32>\xcopy.exe' /Y /I "%TEMP%\NS-P0J7V.tmp\UPD\*" "%APPDATA%\LocalDataNT\"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %APPDATA%\LocalDataNT\pp.pdf
