Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\Default.scr'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Intel Audio Driver' = '<SYSTEM32>\config\lsass.exe'
Malicious functions:
Creates and executes the following:
- <SYSTEM32>\config\lsass.exe
Searches for windows to
bypass different anti-viruses:
- ClassName: 'AVP.MainWindow' WindowName: ''
detect analytical utilities:
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '1'
Modifies file system :
Creates the following files:
- <SYSTEM32>\config\Cache\Dasktop.ini
- <SYSTEM32>\Default.scr
- <SYSTEM32>\config\lsass.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\config\lsass.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Avira AntiVir Personal - Free Antivirus'
- ClassName: '' WindowName: '???????????? ??????? AVZ'
- ClassName: '' WindowName: 'Dr.Web Security Space 5.0 - InstallShield Wizard'
- ClassName: '' WindowName: 'avast! Antivirus Setup'
- ClassName: 'Autoruns' WindowName: ''
- ClassName: 'PROCEXPL' WindowName: ''
- ClassName: '' WindowName: '????????: ?????'
- ClassName: 'AnVirMainFrame' WindowName: ''
