Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\CRMSvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\CRMSvc] 'ImagePath' = '"%APPDATA%\CRMSvc\CRMSvc.exe"'
Modifies file system:
Creates the following files:
- %APPDATA%\CRMSvc\CRMSvc.exe
- %APPDATA%\CRMSvc\CRMSvc.InstallLog
- %APPDATA%\CRMSvc\CRMSvc.InstallState
Deletes the following files:
- %APPDATA%\CRMSvc\CRMSvc.InstallLog
- %APPDATA%\CRMSvc\CRMSvc.InstallState
Network activity:
Connects to:
- 'wp#d':80
- '17#.9.8.183':2247
- '88.##8.58.40':2247
- '17#.#.118.173':2247
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
Miscellaneous:
Creates and executes the following:
- '%APPDATA%\CRMSvc\CRMSvc.exe' and Settings\\%USERNAME%\\Application Data\\CRMSvc\\CRMSvc.exe\" --install
- '%APPDATA%\CRMSvc\CRMSvc.exe' and Settings\\%USERNAME%\\Application Data\\CRMSvc\\CRMSvc.exe\"
Executes the following:
- '<SYSTEM32>\sc.exe' failure \"CRMSvc\" reset= 2 actions= restart/10000
