Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'tray_ico' = 'cmd /c "%WINDIR%\TEMP\tray_tmp.exe" tray'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\zipdrivers] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\zipdrivers] 'ImagePath' = '<Full path to file> srv'
Creates the following services
- 'zipdrivers' <Full path to file> srv
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Injects code into
the following system processes:
- <SYSTEM32>\csrss.exe
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'RunInvalidSignatures' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- [\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\Download] 'RunInvalidSignatures' = '00000001'
- [\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- [\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\Download] 'RunInvalidSignatures' = '00000001'
- [\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [<HKCU>_Classes\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- [<HKCU>_Classes\Software\Microsoft\Internet Explorer\Download] 'RunInvalidSignatures' = '00000001'
- [<HKCU>_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [\REGISTRY\USER\S-1-5-18\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- [\REGISTRY\USER\S-1-5-18\Software\Microsoft\Internet Explorer\Download] 'RunInvalidSignatures' = '00000001'
- [\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
Modifies file system
Creates the following files
- C:\cwwcc.txt
- %WINDIR%\temp\log_012195.txt
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\desktop.ini
- %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini
- C:\log.txt
- C:\boot.ini
- %WINDIR%\temp\bcdedit32.exe
- %WINDIR%\winsetupapi.log
- %WINDIR%\temp\tray_tmp.exe
Network activity
UDP
- DNS ASK su####arsinfo.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\bcdedit32.exe' /set safeboot network
- '%WINDIR%\temp\bcdedit32.exe' /deletevalue safeboot
- '%WINDIR%\syswow64\sc.exe' create "zipdrivers" binpath= "<Full path to file> srv" start= "auto"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start "zipdrivers"' (with hidden window)
- '%WINDIR%\temp\bcdedit32.exe' /set safeboot network' (with hidden window)
- '%WINDIR%\syswow64\shutdown.exe' -r -t 0' (with hidden window)
- '%WINDIR%\temp\bcdedit32.exe' /deletevalue safeboot' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' create "zipdrivers" binpath= "<Full path to file> srv" start= "auto"
- '%WINDIR%\syswow64\net.exe' start "zipdrivers"
- '%WINDIR%\syswow64\net1.exe' start "zipdrivers"
- '%WINDIR%\syswow64\shutdown.exe' -r -t 0
Attempts to shut down the Windows operating system.
