Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\UpdateService.job
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe
- %ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe.config
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\f604cbf1b2a3b09dc9acc464cbac566f_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %ALLUSERSPROFILE%\Application Data\UpdateService\settings.dat
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\index.dat
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YZ93GA5Y\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\JJZF912I\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\IVA3CNWZ\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2L8RABUR\desktop.ini
- C:\Documents and Settings\NetworkService\Cookies\index.dat
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat
Sets the 'hidden' attribute to the following files:
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YZ93GA5Y\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\JJZF912I\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\IVA3CNWZ\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2L8RABUR\desktop.ini
Deletes the following files:
- %WINDIR%\Tasks\UpdateService.job
Network activity:
Connects to:
- 'wp#d':80
- 'ek##ci.net':80
- 'al####aventanas.com':80
- 'me####proxy.com.ua':80
- 'wu#e.hu':80
- 'ne##teg.com':80
- 'po####klubimoy.ru':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
HTTP POST requests:
- http://ek##ci.net/890/modules_info.php?ur###############
- http://al####aventanas.com/890/modules_info.php?ur###############
- http://al####aventanas.com/890/content_log.php?ur###############
- http://me####proxy.com.ua/wp-admin/wp-log.php?ur###############
- http://wu#e.hu/modules_info.php?ur###############
- http://ne##teg.com/modules_info.php?ur###############
- http://po####klubimoy.ru/admin/servis/sale/info.php?ur###############
UDP:
- DNS ASK wp#d
- DNS ASK ek##ci.net
- DNS ASK al####aventanas.com
- DNS ASK me####proxy.com.ua
- DNS ASK wu#e.hu
- DNS ASK ne##teg.com
- DNS ASK po####klubimoy.ru
Miscellaneous:
Creates and executes the following:
- '%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe'
- '%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe' -t
Executes the following:
- '<SYSTEM32>\schtasks.exe' /Delete /TN "UpdateService" /F
- '<SYSTEM32>\schtasks.exe' /Create /RU SYSTEM /SC ONSTART /TN "UpdateService" /TR "\"%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe\" -t"
- '<SYSTEM32>\schtasks.exe' /Run /TN "UpdateService"
