Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\Directory\shell\open\command] '' = '<Full path to file> "%1"'
- [<HKLM>\Software\Classes\Drive\shell\open\command] '' = '<Full path to file> "%1"'
- [<HKLM>\Software\Classes\PROTOCOLS\Filter\text/html] 'CLSID' = '{75EA2845-EAD5-486E-A339-59FED49289A6}'
- [<HKLM>\Software\Classes\Directory\shell\open\command] '' = '%WINDIR%\SysWow64\ntprintQQRRRRRR.exe "%1"'
- [<HKLM>\Software\Classes\Drive\shell\open\command] '' = '%WINDIR%\SysWow64\ntprintQQRRRRRR.exe "%1"'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\MMMMMNN] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\MMMMMNN] 'ImagePath' = '<SYSTEM32>\svchost.exe -k PPPPPPPP'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\MMMMMNN\Parameters] 'ServiceDll' = '<SYSTEM32>\ucmhcWWWWWWWWWW.dll'
Creates the following services
- 'MMMMMNN' <SYSTEM32>\svchost.exe -k PPPPPPPP
Modifies file system
Creates the following files
- %WINDIR%\syswow64\dvhkmkcv.dll
- %WINDIR%\syswow64\winmmxxxxyyyyyy.dll
- %WINDIR%\syswow64\cmutilccccc.exe
- %WINDIR%\syswow64\ntprintqqrrrrrr.exe
- %WINDIR%\syswow64\mfc140chsmnnnnnn.dll.tmp
- %WINDIR%\syswow64\winsrpcxyyyyyyyyy.dll.tmp
- %WINDIR%\syswow64\ucmhcwwwwwwwwww.dll.tmp
- %ProgramFiles(x86)%\internet explorer\kkktkkk.exe
- %ProgramFiles(x86)%\internet explorer\iitiii.exe
- %WINDIR%\syswow64\jjjtjjj.exe
- %ProgramFiles(x86)%\internet explorer\tzzzzzzzzz.exe
- %ProgramFiles(x86)%\internet explorer\yyyyyyyyty.exe
- %WINDIR%\dela.bat
- %WINDIR%\syswow64\kbdjpnkkkllll.dat
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\cmutilccccc.exe
- %WINDIR%\syswow64\ntprintqqrrrrrr.exe
- %WINDIR%\syswow64\mfc140chsmnnnnnn.dll
- %WINDIR%\syswow64\winsrpcxyyyyyyyyy.dll
- %WINDIR%\syswow64\ucmhcwwwwwwwwww.dll
- %ProgramFiles(x86)%\internet explorer\kkktkkk.exe
- %ProgramFiles(x86)%\internet explorer\iitiii.exe
- %WINDIR%\syswow64\jjjtjjj.exe
- %ProgramFiles(x86)%\internet explorer\tzzzzzzzzz.exe
- %ProgramFiles(x86)%\internet explorer\yyyyyyyyty.exe
Moves the following files
- from %WINDIR%\syswow64\mfc140chsmnnnnnn.dll.tmp to %WINDIR%\syswow64\mfc140chsmnnnnnn.dll
- from %WINDIR%\syswow64\winsrpcxyyyyyyyyy.dll.tmp to %WINDIR%\syswow64\winsrpcxyyyyyyyyy.dll
- from %WINDIR%\syswow64\ucmhcwwwwwwwwww.dll.tmp to %WINDIR%\syswow64\ucmhcwwwwwwwwww.dll
Modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk
- %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk
- %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
Deletes itself.
Network activity
Connects to
- '26#.com':80
- 'so##un.com':80
UDP
- DNS ASK 26#.com
- DNS ASK 86#4.cn
- DNS ASK so##un.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\DelA.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\svchost.exe' -k PPPPPPPP
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\DelA.bat
- '%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1
