Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\UpdateService.job
Malicious functions:
Executes the following:
- '<SYSTEM32>\schtasks.exe' /Run /TN "UpdateService"
- '%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe' -t
- '%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe'
- '<SYSTEM32>\schtasks.exe' /Create /RU SYSTEM /SC ONSTART /TN "UpdateService" /TR "\"%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe\" -t"
- '%TEMP%\tmp23207\setup.exe' -i "<Full path to file>"
- '%ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe' -r "%TEMP%\tmp23207\setup.exe"
- '<SYSTEM32>\schtasks.exe' /Delete /TN "UpdateService" /F
Modifies file system:
Creates the following files:
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\SH278X6J\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\WHIJ49YV\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\G9A0FCC3\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat
- C:\Documents and Settings\NetworkService\Cookies\index.dat
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KP7ZC3UX\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\index.dat
- %ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe
- %TEMP%\tmp23207\setup.exe.config
- %TEMP%\tmp23207\setup.exe
- %ALLUSERSPROFILE%\Application Data\UpdateService\settings.dat
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\cc81130e45ebde6a9929da3639ba9de3_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %ALLUSERSPROFILE%\Application Data\UpdateService\UpdateService.exe.config
Sets the 'hidden' attribute to the following files:
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\SH278X6J\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KP7ZC3UX\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\G9A0FCC3\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\WHIJ49YV\desktop.ini
Deletes the following files:
- %TEMP%\tmp23207\setup.exe
Deletes itself.
Network activity:
Connects to:
- 'fa###leorth.com':80
- 'xo##k.ru':80
- 'wp#d':80
- 'ga###ts77.ru':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
HTTP POST requests:
- http://xo##k.ru/libraries/cms/schema/changeitem/info.php?ur###############
- http://fa###leorth.com/info?ur###############
- http://ga###ts77.ru/index.php?ro#############################################
UDP:
- DNS ASK fa###leorth.com
- DNS ASK xo##k.ru
- DNS ASK wp#d
- DNS ASK ga###ts77.ru
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '37bf1adeba324dfe890cca40530636c5'
