Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\NGEN39976_32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NGEN39976_32] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\v2.0_2.0.0.0__d40311db4f897462\WPDShextAutoplay.exe'
Creates the following services
- 'NGEN39976_32' %ALLUSERSPROFILE%\Microsoft\v2.0_2.0.0.0__d40311db4f897462\WPDShextAutoplay.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\wpdshextautoplay.exe
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\dmviewj.ocx
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\sysmone.ocx
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\hhctrlc.ocx
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\activedst.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\rendezvoussessionj.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\stdole2j.tlb
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\slmgri.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\winrmm.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\slmgrp.vbs
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\sysdmb.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\ncpax.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\inetcpli.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\infocardcplp.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\msscriptl.ocx
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\telephonx.cpl
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\wsmanconfig_schemap.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\ndfeventviewu.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\racrulesy.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\xpsrchvwd.xml
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\d3dcompiler_33q.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\odbccu32j.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\vaultclic.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\vdmdbge.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\hcproviderse.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\filemgmtn.dll
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\rcx8d8.tmp
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\rcx8c7.tmp
- %TEMP%\tmp8b6.tmp
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\ndfeventviewk.xml
- nul
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\wpdshextautoplay.exe
Moves the following files
- from %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\rcx8c7.tmp to %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\wpdshextautoplay.exe
- from %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\rcx8d8.tmp to %ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\wpdshextautoplay.exe
Deletes itself.
Network activity
Connects to
- '11#.#2.66.110':10204
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\microsoft\v2.0_2.0.0.0__d40311db4f897462\wpdshextautoplay.exe'
- '%WINDIR%\syswow64\cmd.exe' /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "<Full path to file>" & del "<Full path to file>" > NUL & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "<Full path to file>" & del "<Full path to file>" > NUL & exit
- '%WINDIR%\syswow64\ping.exe' -n 2 127.0.0.1
- '%WINDIR%\syswow64\fsutil.exe' file setzerodata offset=0 length=524288 "<Full path to file>"
