Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\Directory\shell\open\command] '' = '<Full path to file> "%1"'
- [<HKLM>\Software\Classes\Drive\shell\open\command] '' = '<Full path to file> "%1"'
- [<HKLM>\Software\Classes\PROTOCOLS\Filter\text/html] 'CLSID' = '{75EA2845-EAD5-486E-A339-59FED49289A6}'
- [<HKLM>\Software\Classes\Directory\shell\open\command] '' = '%WINDIR%\SysWow64\NlsLexicons0049ZrJZqIY.exe "%1"'
- [<HKLM>\Software\Classes\Drive\shell\open\command] '' = '%WINDIR%\SysWow64\NlsLexicons0049ZrJZqIY.exe "%1"'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\GJNPrvZCG] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\GJNPrvZCG] 'ImagePath' = '<SYSTEM32>\svchost.exe -k BEHKMPtw'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\GJNPrvZCG\Parameters] 'ServiceDll' = '<SYSTEM32>\WiaExtensionHost64FHJMqvyDF.dll'
Creates the following services
- 'GJNPrvZCG' <SYSTEM32>\svchost.exe -k BEHKMPtw
Modifies file system
Creates the following files
- %WINDIR%\syswow64\okixmjlug.dll
- %WINDIR%\syswow64\spwizreskiged.dll
- %WINDIR%\syswow64\verclsidrqponlk.exe
- %WINDIR%\syswow64\nlslexicons0049zrjzqiy.exe
- %WINDIR%\syswow64\shwebsvcshwlao.dll.tmp
- %WINDIR%\syswow64\pnrpnspaaaaa.dll.tmp
- %WINDIR%\syswow64\wiaextensionhost64fhjmqvydf.dll.tmp
- %ProgramFiles(x86)%\internet explorer\cctcdbccc.exe
- %ProgramFiles(x86)%\internet explorer\ithgedbaaa.exe
- %WINDIR%\syswow64\hjmtoqqpqp.exe
- %ProgramFiles(x86)%\internet explorer\uvvtttr.exe
- %ProgramFiles(x86)%\internet explorer\utzzazy.exe
- %WINDIR%\dela.bat
- %WINDIR%\syswow64\wbemcomnyyywwwut.dat
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\verclsidrqponlk.exe
- %WINDIR%\syswow64\nlslexicons0049zrjzqiy.exe
- %WINDIR%\syswow64\shwebsvcshwlao.dll
- %WINDIR%\syswow64\pnrpnspaaaaa.dll
- %WINDIR%\syswow64\wiaextensionhost64fhjmqvydf.dll
- %ProgramFiles(x86)%\internet explorer\cctcdbccc.exe
- %ProgramFiles(x86)%\internet explorer\ithgedbaaa.exe
- %WINDIR%\syswow64\hjmtoqqpqp.exe
- %ProgramFiles(x86)%\internet explorer\utzzazy.exe
Moves the following files
- from %WINDIR%\syswow64\shwebsvcshwlao.dll.tmp to %WINDIR%\syswow64\shwebsvcshwlao.dll
- from %WINDIR%\syswow64\pnrpnspaaaaa.dll.tmp to %WINDIR%\syswow64\pnrpnspaaaaa.dll
- from %WINDIR%\syswow64\wiaextensionhost64fhjmqvydf.dll.tmp to %WINDIR%\syswow64\wiaextensionhost64fhjmqvydf.dll
Modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk
- %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk
- %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
Deletes itself.
Network activity
Connects to
- 'ha##23.com':80
- 'xi##.net':80
- 'so##un.com':80
TCP
HTTP GET requests
- http://www.ha##23.com/
- http://www.xi##.net/
- http://www.so##un.com/
UDP
- DNS ASK ha##23.com
- DNS ASK xi##.net
- DNS ASK so##un.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\DelA.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\svchost.exe' -k BEHKMPtw
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\DelA.bat
- '%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1
