Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Mstsc' = '%ALLUSERSPROFILE%\Microsoft\mstsc.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'cisvc' = '%HOMEPATH%\Local Settings\Application Data\Microsoft\Windows\cisvc.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Mstsc' = '%HOMEPATH%\Local Settings\Application Data\Microsoft\mstsc.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'IEudInit' = '%WINDIR%\ieudinit.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%WINDIR%\clipsrv.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '%APPDATA%\mqtgsvc.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'DCOM' = '%WINDIR%\dllhost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft RSVP' = '%APPDATA%\rsvp.exe'
Modifies file system
Creates the following files
- %TEMP%\twain002.mtx
- %WINDIR%\rcxda2e.tmp
- %WINDIR%\dllhost.exe
- %APPDATA%\rcxd8d6.tmp
- %APPDATA%\mqtgsvc.exe
- %WINDIR%\rcxd79d.tmp
- %WINDIR%\clipsrv.exe
- %APPDATA%\rsvp.exe
- %WINDIR%\rcxd616.tmp
- %HOMEPATH%\local settings\application data\microsoft\rcxd422.tmp
- %HOMEPATH%\local settings\application data\microsoft\mstsc.exe
- %HOMEPATH%\local settings\application data\microsoft\windows\rcxd26c.tmp
- %HOMEPATH%\local settings\application data\microsoft\windows\cisvc.exe
- %ALLUSERSPROFILE%\microsoft\rcxd059.tmp
- %ALLUSERSPROFILE%\microsoft\mstsc.exe
- %WINDIR%\ieudinit.exe
- %APPDATA%\rcxdc61.tmp
Moves the following files
- from %ALLUSERSPROFILE%\microsoft\rcxd059.tmp to %ALLUSERSPROFILE%\microsoft\mstsc.exe
- from %HOMEPATH%\local settings\application data\microsoft\windows\rcxd26c.tmp to %HOMEPATH%\local settings\application data\microsoft\windows\cisvc.exe
- from %HOMEPATH%\local settings\application data\microsoft\rcxd422.tmp to %HOMEPATH%\local settings\application data\microsoft\mstsc.exe
- from %WINDIR%\rcxd616.tmp to %WINDIR%\ieudinit.exe
- from %WINDIR%\rcxd79d.tmp to %WINDIR%\clipsrv.exe
- from %APPDATA%\rcxd8d6.tmp to %APPDATA%\mqtgsvc.exe
- from %WINDIR%\rcxda2e.tmp to %WINDIR%\dllhost.exe
- from %APPDATA%\rcxdc61.tmp to %APPDATA%\rsvp.exe
Network activity
Connects to
- 'ms###csi.com':80
UDP
- DNS ASK ly###s-db.org
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\microsoft\mstsc.exe' /c 90
- '%ALLUSERSPROFILE%\microsoft\mstsc.exe' /c 67
- '%ALLUSERSPROFILE%\microsoft\mstsc.exe' /r
- '%APPDATA%\rsvp.exe' /c 97
- '%ALLUSERSPROFILE%\microsoft\mstsc.exe' /c 50
- '%WINDIR%\ieudinit.exe' /c 76
- '%APPDATA%\rsvp.exe' /c 69
- '%WINDIR%\dllhost.exe' /c 4
- '%HOMEPATH%\local settings\application data\microsoft\windows\cisvc.exe' /c 95
- '%HOMEPATH%\local settings\application data\microsoft\mstsc.exe' /c 16
- '%WINDIR%\clipsrv.exe' /c 17
- '%WINDIR%\clipsrv.exe' /c 3
- '%APPDATA%\mqtgsvc.exe' /c 73
- '%WINDIR%\ieudinit.exe' /c 19
- '%HOMEPATH%\local settings\application data\microsoft\mstsc.exe' /c 2
- '%WINDIR%\dllhost.exe' /c 36
- '%HOMEPATH%\local settings\application data\microsoft\windows\cisvc.exe' /c 75
- '%APPDATA%\mqtgsvc.exe' /c 60
- '%HOMEPATH%\local settings\application data\microsoft\windows\cisvc.exe' /c 95' (with hidden window)
- '%WINDIR%\ieudinit.exe' /c 76' (with hidden window)
- '%APPDATA%\mqtgsvc.exe' /c 73' (with hidden window)
- '%HOMEPATH%\local settings\application data\microsoft\mstsc.exe' /c 16' (with hidden window)
- '%WINDIR%\dllhost.exe' /c 36' (with hidden window)
- '%ALLUSERSPROFILE%\microsoft\mstsc.exe' /c 50' (with hidden window)
- '%ALLUSERSPROFILE%\microsoft\mstsc.exe' /c 67' (with hidden window)
- '%WINDIR%\clipsrv.exe' /c 17' (with hidden window)
- '%WINDIR%\clipsrv.exe' /c 3' (with hidden window)
- '%WINDIR%\dllhost.exe' /c 4' (with hidden window)
- '%APPDATA%\mqtgsvc.exe' /c 60' (with hidden window)
- '%WINDIR%\ieudinit.exe' /c 19' (with hidden window)
- '%HOMEPATH%\local settings\application data\microsoft\mstsc.exe' /c 2' (with hidden window)
- '%HOMEPATH%\local settings\application data\microsoft\windows\cisvc.exe' /c 75' (with hidden window)
- '%ALLUSERSPROFILE%\microsoft\mstsc.exe' /c 90' (with hidden window)
- '%ALLUSERSPROFILE%\microsoft\mstsc.exe' /r' (with hidden window)
- '%APPDATA%\rsvp.exe' /c 69' (with hidden window)
- '%APPDATA%\rsvp.exe' /c 97' (with hidden window)
