Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CTFMON.CPL' = 'ctfmon.cmd'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,ctfmon.cpl.cmd'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = 'map32.cmd'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe] 'Debugger' = 'map32.cmd'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'Debugger' = 'talangor.exc'
Creates the following files on removable media
- <Drive name for removable media>:\autorun.inf
Modifies file system
Creates the following files
- %TEMP%\2ae6.tmp\b2e.exe
- %TEMP%\2e31.tmp\batfile.bat
- <Current directory>\config.ini
- %WINDIR%\syswow64\ghayem.exe
- %WINDIR%\syswow64\ctfmon.cpl.cmd
- %WINDIR%\syswow64\map32.cmd
- C:\auto70717.reg
- C:\sph70716.reg
- C:\reg70716.reg
- C:\task70716.reg
- C:\atrib70716.reg
- <Current directory>\autorun.inf
- %WINDIR%\syswow64\ddeshare.dll
- C:\autorun.inf
- D:\autorun.inf
- %TEMP%\selfdel0.bat
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\ghayem.exe
- %WINDIR%\syswow64\ctfmon.cpl.cmd
- C:\autorun.inf
- D:\autorun.inf
- <Drive name for removable media>:\autorun.inf
- <Current directory>\autorun.inf
Deletes the following files
- C:\auto70717.reg
- C:\sph70716.reg
- C:\task70716.reg
- C:\atrib70716.reg
- C:\reg70716.reg
- %TEMP%\2e31.tmp\batfile.bat
- <Current directory>\config.ini
- %TEMP%\2ae6.tmp\b2e.exe
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%TEMP%\2ae6.tmp\b2e.exe' %TEMP%\2AE6.tmp\b2e.exe <Current directory> "<Full path to file>"
- '%WINDIR%\syswow64\ghayem.exe' +h +s +r <Drive name for removable media>:\autorun.inf
- '%WINDIR%\syswow64\ghayem.exe' +h +s <Drive name for removable media>:\Explore.exe
- '%WINDIR%\syswow64\ghayem.exe' +h +s +r d:\autorun.inf
- '%WINDIR%\syswow64\ghayem.exe' +h +s d:\Explore.exe
- '%WINDIR%\syswow64\ghayem.exe' +h +s +r c:\autorun.inf
- '%WINDIR%\syswow64\ghayem.exe' +h +s c:\Explore.exe
- '%WINDIR%\syswow64\ghayem.exe' -h -s -r <Drive name for removable media>:\Explore.exe
- '%WINDIR%\syswow64\ghayem.exe' -h -s -r <Drive name for removable media>:\autorun.inf
- '%WINDIR%\syswow64\ghayem.exe' -h -s -r d:\Explore.exe
- '%WINDIR%\syswow64\ghayem.exe' -h -s -r d:\autorun.inf
- '%WINDIR%\syswow64\ghayem.exe' -h -s -r c:\Explore.exe
- '%WINDIR%\syswow64\ghayem.exe' -h -s -r c:\autorun.inf
- '%WINDIR%\syswow64\ghayem.exe' -h -s -r autorun.inf
- '%WINDIR%\syswow64\ghayem.exe' -h -s Explore.exe
- '%WINDIR%\syswow64\ghayem.exe' -h -s <SYSTEM32>\map32.cmd
- '%WINDIR%\syswow64\ghayem.exe' +h +s <SYSTEM32>\ctfmon.cpl.cmd
- '%WINDIR%\syswow64\ghayem.exe' -h -s <SYSTEM32>\ctfmon.cpl.cmd
- '%WINDIR%\syswow64\ghayem.exe' +h +s <SYSTEM32>\ghayem.exe
- '%WINDIR%\syswow64\ghayem.exe' +h +s +r autorun.inf
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\2E31.tmp\batfile.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\selfdel0.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\2E31.tmp\batfile.bat" "
- '%WINDIR%\syswow64\regedit.exe' /s c:\auto70717.reg
- '%WINDIR%\syswow64\regedit.exe' /s c:\sph70716.reg
- '%WINDIR%\syswow64\regedit.exe' /s c:\reg70716.reg
- '%WINDIR%\syswow64\regedit.exe' /s c:\task70716.reg
- '%WINDIR%\syswow64\regedit.exe' /s c:\atrib70716.reg
- '%WINDIR%\syswow64\explorer.exe' .
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\selfdel0.bat" "
