Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '360Safetray' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '360sd' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'QQvvaizfihk' = '"%ProgramFiles(x86)%\vvaizfihk\svchost.exe"'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'vvaizfihk' = '"A:\vvaizfihk.exe"'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'vvaizfihk' = '"C:\vvaizfihk.exe"'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'vvaizfihk' = '"D:\vvaizfihk.exe"'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'vvaizfihk' = '"E:\vvaizfihk.exe"'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'vvaizfihk' = '"<Drive name for removable media>:\vvaizfihk.exe"'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ProcKiller] 'ImagePath' = '%ProgramFiles(x86)%\vvaizfihk\ProcKiller.sys'
- [<HKLM>\System\CurrentControlSet\Services\hyf55] 'ImagePath' = '%TEMP%\UQByBRx.sys'
Creates the following services
- 'ProcKiller' %ProgramFiles(x86)%\vvaizfihk\ProcKiller.sys
- 'hyf55' %TEMP%\UQByBRx.sys
Creates the following files on removable media
- <Drive name for removable media>:\fvvaizfihk.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- %WINDIR%\vvaizfihk\svchost.exe
- %ProgramFiles(x86)%\vvaizfihk\svchost.exe
- %ProgramFiles(x86)%\vvaizfihk\prockiller.sys
- %WINDIR%\temp\uddfa16.tmp
- %TEMP%\uqbybrx.sys
- %WINDIR%\dll_vvaizfihk\svcdll.dll
- %WINDIR%\vvaizfihk\vvaizfihk.exe
- C:\cvvaizfihk.exe
- C:\autorun.inf
- D:\dvvaizfihk.exe
- D:\autorun.inf
Sets the 'hidden' attribute to the following files
- %WINDIR%\vvaizfihk\svchost.exe
- %ProgramFiles(x86)%\vvaizfihk\svchost.exe
- %ProgramFiles(x86)%\vvaizfihk\prockiller.sys
- %WINDIR%\vvaizfihk\vvaizfihk.exe
- C:\autorun.inf
- D:\autorun.inf
- <Drive name for removable media>:\autorun.inf
Deletes the following files
- %WINDIR%\temp\uddfa16.tmp
- %ProgramFiles(x86)%\vvaizfihk\prockiller.sys
- %TEMP%\uqbybrx.sys
Substitutes the following files
- %TEMP%\uqbybrx.sys
Deletes itself.
Network activity
Connects to
- 'us###.qzone.qq.com':80
- 'us###.qzone.qq.com':443
- 'cr#.##gicert-cn.com':80
- 'oc##.dcocsp.cn':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHv1Dj%2BciPJEWH5JNtwL5Y07mRqwQUxBF%2BiECGwkG%2FZfMa4bRTQKOr7H0CEArIzKqFYmE3jrS4gQrE3QI%3D
UDP
- DNS ASK us###.qzone.qq.com
- DNS ASK oc##.dcocsp.cn
- DNS ASK cr#.##gicert-cn.com
- DNS ASK microsoft.com
- DNS ASK cs.##jiqr.pw
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\vvaizfihk\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start SampleService' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>"
- '%WINDIR%\syswow64\net.exe' start SampleService
- '%WINDIR%\syswow64\net1.exe' start SampleService
