Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Realtek HD Audio' = '%PROGRAMDATA%\RealtekHD\taskhostw.exe'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- %TEMP%\aut2869.tmp
- %PROGRAMDATA%\windowstask\winlogon.exe
- %PROGRAMDATA%\windowstask\10
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\lt3xxrmc\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\kjrepm2g\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\0vretydg\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\41a7tdnq\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %PROGRAMDATA%\windowstask\winlogon.exe
- %PROGRAMDATA%\windowstask\10
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\lt3xxrmc\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\kjrepm2g\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\0vretydg\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\41a7tdnq\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\aut2869.tmp
- <SYSTEM32>\tasks\adobe acrobat update task
- %WINDIR%\tasks\adobe flash player updater.job
- <SYSTEM32>\tasks\adobe flash player updater
- <SYSTEM32>\tasks\officesoftwareprotectionplatform\svcrestarttask
Substitutes the following files
- %PROGRAMDATA%\ntuser.pol
- %HOMEPATH%\ntuser.pol
Network activity
UDP
- DNS ASK so###uny.com
Miscellaneous
Creates and executes the following
- '%PROGRAMDATA%\windowstask\winlogon.exe'
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /query /fo list' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ipconfig /flushdns' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c gpupdate /force' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "Adobe Acrobat Update Task" /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "Adobe Flash Player Updater" /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "OfficeSoftwareProtectionPlatform\SvcRestartTask" /F' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /query /fo list
- '%WINDIR%\syswow64\schtasks.exe' /query /fo list
- '<SYSTEM32>\cmd.exe' /c ipconfig /flushdns
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\cmd.exe' /c gpupdate /force
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "Adobe Acrobat Update Task" /F
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "Adobe Flash Player Updater" /F
- '%WINDIR%\syswow64\cmd.exe' /C schtasks /Delete /TN "OfficeSoftwareProtectionPlatform\SvcRestartTask" /F
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Adobe Acrobat Update Task" /F
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Adobe Flash Player Updater" /F
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "OfficeSoftwareProtectionPlatform\SvcRestartTask" /F
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '<SYSTEM32>\raserver.exe' /offerraupdate
