Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Modifies file system:
Creates the following files:
- C:\327882R2FWJFW\023.dat
- C:\327882R2FWJFW\RestoreO4.bat
- C:\327882R2FWJFW\region.dat
- C:\327882R2FWJFW\Qoo.bat
- C:\327882R2FWJFW\pv.cfexe
- C:\327882R2FWJFW\Purity.dat
- C:\327882R2FWJFW\psexec.cfexe
- C:\327882R2FWJFW\Prep.cmd
- C:\327882R2FWJFW\Policies.dat
- C:\327882R2FWJFW\restore_pt.vbs
- C:\327882R2FWJFW\OSid.vbs
- C:\327882R2FWJFW\NirCmd.inf
- C:\327882R2FWJFW\nircmd.com
- C:\327882R2FWJFW\NirCmd.cfexe
- C:\327882R2FWJFW\NetworkService.dat
- C:\327882R2FWJFW\netsvc.xp.dat
- C:\327882R2FWJFW\netsvc.vista.dat
- C:\327882R2FWJFW\netsvc.dat
- C:\327882R2FWJFW\netsvc.bad.dat
- C:\327882R2FWJFW\NirCmdC.cfexe
- C:\327882R2FWJFW\rogues.dat
- C:\327882R2FWJFW\safeboot.dat
- C:\327882R2FWJFW\safeboot.def.dat
- C:\327882R2FWJFW\zhsvc.dat
- C:\327882R2FWJFW\zDomain.dat
- C:\327882R2FWJFW\WhiteLegacy.dat
- C:\327882R2FWJFW\whitedirB.dat
- C:\327882R2FWJFW\vfind.cfexe
- C:\327882R2FWJFW\system_ini.dat
- C:\327882R2FWJFW\swxcacls.cfexe
- C:\327882R2FWJFW\swsc.cfexe
- C:\327882R2FWJFW\swreg.cfexe
- C:\327882R2FWJFW\svc_wht.dat
- C:\327882R2FWJFW\svchost.vista.dat
- C:\327882R2FWJFW\svchost.dat
- C:\327882R2FWJFW\SvcDrv.vbs
- C:\327882R2FWJFW\SF.cfexe
- C:\327882R2FWJFW\setpath.cfexe
- C:\327882R2FWJFW\SetEnvmt.bat
- C:\327882R2FWJFW\sed.cfexe
- C:\327882R2FWJFW\SafeBootRepair.bat
- C:\327882R2FWJFW\safeboot.def.vista.dat
- C:\327882R2FWJFW\ND_.bat
- C:\327882R2FWJFW\zip.cfexe
- C:\327882R2FWJFW\ndis_combofix.dat
- C:\327882R2FWJFW\MoveIt.bat
- C:\327882R2FWJFW\ERUNT.cfexe
- C:\327882R2FWJFW\ERDNTWIN.LOC
- C:\327882R2FWJFW\ERDNTDOS.LOC
- C:\327882R2FWJFW\ERDNT.e_e
- C:\327882R2FWJFW\dumphive.cfexe
- C:\327882R2FWJFW\Disclaimer.bat
- C:\327882R2FWJFW\DelClsid.bat
- C:\327882R2FWJFW\dd.cfexe
- C:\327882R2FWJFW\ERUNT.LOC
- C:\327882R2FWJFW\Creg.dat
- C:\327882R2FWJFW\Combobatch.bat
- C:\327882R2FWJFW\Combo-Fix.sys
- C:\327882R2FWJFW\clsid.dat
- C:\327882R2FWJFW\catchme.cfexe
- C:\327882R2FWJFW\C.bat
- C:\327882R2FWJFW\BootSect
- C:\327882R2FWJFW\Boot.bat
- C:\327882R2FWJFW\023v.dat
- C:\327882R2FWJFW\Comspec.bat
- C:\327882R2FWJFW\Exe.reg
- C:\327882R2FWJFW\executables.dat
- C:\327882R2FWJFW\extract.cfexe
- C:\327882R2FWJFW\moveex.cfexe
- C:\327882R2FWJFW\md5deep.cfexe
- C:\327882R2FWJFW\LocalSystemNetworkRestricted.dat
- C:\327882R2FWJFW\LocalServiceNetworkRestricted.dat
- C:\327882R2FWJFW\LocalService.dat
- C:\327882R2FWJFW\LocalDrive.vbs
- C:\327882R2FWJFW\lnkread.vbs
- C:\327882R2FWJFW\List-C.bat
- C:\327882R2FWJFW\LFN.vbs
- C:\327882R2FWJFW\Lang.bat
- C:\327882R2FWJFW\history.bat
- C:\327882R2FWJFW\handle.cfexe
- C:\327882R2FWJFW\gsar.cfexe
- C:\327882R2FWJFW\grep.cfexe
- C:\327882R2FWJFW\FProps.vbs
- C:\327882R2FWJFW\FIXLSP.bat
- C:\327882R2FWJFW\FIND3M.bat
- C:\327882R2FWJFW\Fin.dat
- C:\327882R2FWJFW\fdsv.cfexe
- C:\327882R2FWJFW\mtee.cfexe
- C:\Bug.txt
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following:
- 'C:\327882R2FWJFW\nircmd.com' shexec install 327882R2FWJFW\nircmd.inf
- 'C:\327882R2FWJFW\nircmd.com' execmd call 327882R2FWJFW\prep.cmd >Bug.txt
- 'C:\327882R2FWJFW\NirCmd.cfexe' win close ititle "ComboFix"
- 'C:\327882R2FWJFW\swreg.cfexe' add "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve /d "<Full path to file>"
Executes the following:
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 C:\327882R2FWJFW\nircmd.inf
- '%WINDIR%\regedit.exe' /s 327882R2FWJFW\EXE.reg
- '<SYSTEM32>\cmd.exe' /c call 327882R2FWJFW\prep.cmd >Bug.txt
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
