Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System] 'Shell' = '%WINDIR%\Explorer.exe <SYSTEM32>\tlntsvi_5807.exe'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Sanseex] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Sanseex] 'ImagePath' = '<SYSTEM32>\Servicx.exe'
Creates the following services
- 'Sanseex' <SYSTEM32>\Servicx.exe
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\nsq8b5e.tmp\system.dll
- %TEMP%\setup_3g.exe
- %WINDIR%\syswow64\tlntsvi.exe
- %TEMP%\nsq8b5e.tmp\simplesc.dll
- %HOMEPATH%\desktop\internet explorer.lnk
- %TEMP%\srun67.bat
- %TEMP%\srun45.bat
- %TEMP%\srun81.bat
- %TEMP%\srun83.bat
- %TEMP%\srun91.bat
- %APPDATA%\microsoft\internet explorer\quick launch\æô¶¯ internet explorer ä¯à à æ÷.lnk
- %TEMP%\srun61.bat
- %TEMP%\nsq8b5e.tmp\nsrandom.dll
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\desktop\internet explorer.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\æô¶¯ internet explorer ä¯à à æ÷.lnk
Moves the following files
- from %WINDIR%\syswow64\tlntsvi.exe to %WINDIR%\syswow64\tlntsvi_5807.exe
Modifies the following files
- %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
Network activity
Connects to
- '11##c.com':80
TCP
HTTP POST requests
- http://www.11##c.com/count/xml.php
UDP
- DNS ASK 11##c.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%TEMP%\setup_3g.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun67.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun45.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun81.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun83.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun91.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun61.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun67.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun45.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun81.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun83.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun91.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\srun61.bat" "
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
- '%WINDIR%\syswow64\cacls.exe' "%HOMEPATH%\Desktop\Internet Explorer.lnk" /G Everyone:R /C
- '%WINDIR%\syswow64\cacls.exe' "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\╞⌠╢В» Internet Explorer ΣВ»└└╞≈.lnk" /G Everyone:R /C
- '%WINDIR%\syswow64\cacls.exe' "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\\Launch Internet Explorer Browser.lnk" /G Everyone:R /C
