Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Calabar6' = '%HOMEPATH%\Parepidid5\Ukendskabe7.scr'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'Startup key' = '%HOMEPATH%\subfolder1\filename1.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'UDP Subsystem' = '%ProgramFiles(x86)%\UDP Subsystem\udpss.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\udp subsystem
- <SYSTEM32>\tasks\udp subsystem task
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe
Modifies file system
Creates the following files
- %HOMEPATH%\parepidid5\ukendskabe7.scr
- %PROGRAMDATA%\7433cdb324b04dd5e3c3db213381216c7c539baa
- %PROGRAMDATA%\130532\130435\sihast.exe
- %HOMEPATH%\subfolder1\filename1.exe
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\run.dat
- %ProgramFiles(x86)%\udp subsystem\udpss.exe
- %TEMP%\tmpcd66.tmp
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\task.dat
- %TEMP%\tmpcf3c.tmp
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\catalog.dat
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\storage.dat
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\settings.bin
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Sets the 'hidden' attribute to the following files
- %PROGRAMDATA%\7433cdb324b04dd5e3c3db213381216c7c539baa
Deletes the following files
- %TEMP%\tmpcd66.tmp
- %TEMP%\tmpcf3c.tmp
Network activity
TCP
- 'on####ve.live.com':443
- 're####.#n.files.1drv.com':443
- '18#.#65.153.39':5807
- '18#.#65.153.39':52802
UDP
- DNS ASK on####ve.live.com
- DNS ASK re####.#n.files.1drv.com
- DNS ASK se####.#n.files.1drv.com
- DNS ASK su####.#n.files.1drv.com
Miscellaneous
Creates and executes the following
- '%PROGRAMDATA%\130532\130435\sihast.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "UDP Subsystem" /xml "%TEMP%\tmpCD66.tmp"
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "UDP Subsystem Task" /xml "%TEMP%\tmpCF3C.tmp"
