Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\uFNW.dll] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\uFNW.dll] 'ImagePath' = '<SYSTEM32>\regsvr32.exe "<SYSTEM32>\LvlDE\uFNW.dll"'
Creates the following services
- 'uFNW.dll' <SYSTEM32>\regsvr32.exe "<SYSTEM32>\LvlDE\uFNW.dll"
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' ..\xwnlm.ocx
Modifies file system
Creates the following files
- %HOMEPATH%\xwnlm.ocx
- <Current directory>\45b31000
Moves the following files
- from %HOMEPATH%\xwnlm.ocx to <SYSTEM32>\lvlde\ufnw.dll
Substitutes the following files
- <PATH_SAMPLE>.xls
Network activity
Connects to
- 'kr###iforms.com':443
- '18#.#.212.130':7080
- '20#.#4.166.162':443
- '14#.#9.226.45':443
- '5.#.116.246':8080
- '20#.#14.109.124':443
- '1.##4.2.232':8080
- '20#.#26.98.206':8080
- '18#.#.135.165':8080
- '77.##.247.144':8080
- '10#.50.0.91':8080
- '13#.#00.24.231':80
- '21#.#41.20.155':443
- '15#.#5.66.124':8080
- '17#.#05.70.96':443
- 'le###ausen.nl':80
- 'ma###nmester.nu':80
- 'ma###naxel.dk':80
- 'la##or.com':80
- 'ku##doo.com':80
- 'r3.#.lencr.org':80
- 'x1.#.lencr.org':80
- '16#.#6.142.56':8080
- '21#.#58.226.206':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgNNbOa6nnSFmN7r6DsKYPL7EQ%3D%3D
- http://ku##doo.com/wp-includes/K5tQAray/
- http://la##or.com/sklep2/nYjXinRwHU5vyY/
- http://ma###naxel.dk/MlKL23H1XV/Fi8np5TB4PH/
- http://ma###nmester.nu/loges/oJZe8Lp0h/
- http://le###ausen.nl/wwvv2/TPuvLWwtaCwvAeGThTlQ/
Other
- 'kr###iforms.com':443
- '15#.#5.66.124':8080
- '13#.#00.24.231':80
- '20#.#26.98.206':8080
- '20#.#14.109.124':443
- '14#.#9.226.45':443
UDP
- DNS ASK kr###iforms.com
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
- DNS ASK ku##doo.com
- DNS ASK la##or.com
- DNS ASK ma###naxel.dk
- DNS ASK ma###nmester.nu
- DNS ASK le###ausen.nl
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' ..\xwnlm.ocx' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' "<SYSTEM32>\LvlDE\uFNW.dll"
