Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'MSSMSGS' = 'rundll32.exe winlqj32.rom,XRhRun'
Malicious functions
Injects code into
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %TEMP%\tweffaf.tmp
- %WINDIR%\syswow64\winlqj32.rom
- %TEMP%\win9c3.tmp
- %TEMP%\tweffaf.bat
- <PATH_SAMPLE>.bat
Deletes the following files
- %TEMP%\tweffaf.tmp
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://sm####security.biz/img/cmd.php?c=##########################################
- http://ww#.###rt-security.biz/
UDP
- DNS ASK se###hmeup.biz
- DNS ASK sm####security.biz
- DNS ASK ww#.###rt-security.biz
Miscellaneous
Searches for the following windows
- ClassName: 'IEFrame' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\tweFFAF.bat"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "<PATH_SAMPLE>.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\tweFFAF.bat"
- '%WINDIR%\syswow64\cmd.exe' /c "<PATH_SAMPLE>.bat"
