Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\at1.job
- <SYSTEM32>\tasks\at1
- %WINDIR%\tasks\at2.job
- <SYSTEM32>\tasks\at2
- %WINDIR%\tasks\at3.job
- <SYSTEM32>\tasks\at3
- %WINDIR%\tasks\at4.job
- <SYSTEM32>\tasks\at4
Malicious functions
Executes the following
- '%WINDIR%\syswow64\at.exe' 02:42 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"
- '%WINDIR%\syswow64\at.exe' 20:38 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"
- '%WINDIR%\syswow64\at.exe' 14:11 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"
- '%WINDIR%\syswow64\at.exe' 08:59 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"
Modifies settings of Windows Internet Explorer
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'
Modifies file system
Creates the following files
- %TEMP%\316078730.exe
- %TEMP%\126777921.bin
- %TEMP%\196218113.exe
- %WINDIR%\syswow64\ccfgbkend.dll
- %WINDIR%\syswow64\msrra.exe
- %TEMP%\3041525557.bin
Deletes the following files
- %TEMP%\316078730.exe
- %TEMP%\196218113.exe
- %TEMP%\126777921.bin
Network activity
Connects to
- 'google.com':80
- 'google.com':443
- 'microsoft.com':80
- 'kw###ame.com':80
TCP
HTTP GET requests
- http://google.com/
- http://www.google.com/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://kw###ame.com/indeh.php?u=#########################################
Other
- 'google.com':443
UDP
- DNS ASK google.com
- DNS ASK microsoft.com
- DNS ASK kw###ame.com
Miscellaneous
Creates and executes the following
- '%TEMP%\316078730.exe' "%TEMP%\126777921.bin"
- '%TEMP%\196218113.exe' "%TEMP%\126777921.bin"
- '%TEMP%\3041525557.bin'
- '%WINDIR%\syswow64\cmd.exe' /c at 20:38 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c at 02:42 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c at 14:11 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c at 08:59 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\ccfgbkend.dll"
- '%WINDIR%\syswow64\cmd.exe' /c at 20:38 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"
- '%WINDIR%\syswow64\cmd.exe' /c at 02:42 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"
- '%WINDIR%\syswow64\cmd.exe' /c at 14:11 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"
- '%WINDIR%\syswow64\cmd.exe' /c at 08:59 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "<SYSTEM32>\msrra.exe"
