Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\services\wmiApSrv] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%TEMP%\msiexec.exe'
Executes the following:
- '<SYSTEM32>\sysprep\sysprep.exe'
- '<SYSTEM32>\consent.exe' 876 352 00000000002DA3D0
- '<SYSTEM32>\net.exe' stop wmiapsrv
- '<SYSTEM32>\conhost.exe' start wmiapsrv
- '<SYSTEM32>\net1.exe' stop wmiapsrv
- '<SYSTEM32>\cmd.exe' /c %TEMP%\tem8A44.tmp.bat
- '<SYSTEM32>\rundll32.exe' "%APPDATA%\Roaming\tmp821B.tmp", tInsMain <Full path to virus>
- '<SYSTEM32>\consent.exe' 876 256 0000000003117600
- '<SYSTEM32>\DllHost.exe' /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
- '<SYSTEM32>\DllHost.exe' /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- <SYSTEM32>\wbem\loadperf.dll
- %TEMP%\tmpA525.tmp
- <SYSTEM32>\w88date.ini
- <SYSTEM32>\sysprep\CRYPTBASE.DLL
- <SYSTEM32>\sysprep\Panther\setupact.log
- <SYSTEM32>\sysprep\Panther\diagwrn.xml
- <SYSTEM32>\sysprep\Panther\diagerr.xml
- %TEMP%\cryptbase.dll
- %APPDATA%\Roaming\tmp821B.tmp
- %APPDATA%\Roaming\tmp81EB.tmp
- %TEMP%\msiexec.exe
- %TEMP%\tmp9877.tmp
- <SYSTEM32>\w88date.ime
- %TEMP%\tem8A44.tmp.bat
Deletes the following files:
- %TEMP%\tmpA525.tmp
- %TEMP%\msiexec.exe
- %TEMP%\cryptbase.dll
- %APPDATA%\Roaming\tmp821B.tmp
- %APPDATA%\Roaming\tmp81EB.tmp
- %TEMP%\tmp9877.tmp
Deletes itself.
