Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"C:\totalcmd\LANGUAGE\System.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"%WINDIR%\Panther\setup.exe\spoolsv.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"C:\PerfLogs\Admin\iexplore.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"%ProgramFiles%\livesrv\smss.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsm' = '"%ALLUSERSPROFILE%\Adobe\ARM\Reader_15.007.20033\lsm.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"%ProgramFiles%\Uninstall Information\wininit.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\wininit
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- C:\totalcmd\language\system.exe
- C:\totalcmd\language\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a
- %WINDIR%\panther\setup.exe\spoolsv.exe
- %WINDIR%\panther\setup.exe\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4
- C:\perflogs\admin\iexplore.exe
- C:\perflogs\admin\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %ProgramFiles%\livesrv\smss.exe
- %ProgramFiles%\livesrv\69ddcba757bf72f7d36c464c71f42baab150b2b9
- %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\lsm.exe
- %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\101b941d020240259ca4912829b53995ad543df6
- %ProgramFiles%\uninstall information\wininit.exe
- %ProgramFiles%\uninstall information\560854153607923c4c5f107085a7db67be01f252
Network activity
Connects to
- '62.##9.7.201':80
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\uninstall information\wininit.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\System.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'%WINDIR%\Panther\setup.exe\spoolsv.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\PerfLogs\Admin\iexplore.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%ProgramFiles%\livesrv\smss.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Adobe\ARM\Reader_15.007.20033\lsm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%ProgramFiles%\Uninstall Information\wininit.exe'" /rl HIGHEST /f
