Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{6D47454B-F227-3099-3235-254B730F1E4E}' = '"%APPDATA%\Epta\iwep.exe"'
Substitutes the following executable system files:
- <SYSTEM32>\dllcache\termsrv.dll with <SYSTEM32>\dllcache\termsrv.dll.new
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Epta\iwep.exe'
Executes the following:
- '<SYSTEM32>\svchost.exe' --HiddenServiceDir "%APPDATA%\tor\hidden_service" --HiddenServicePort "1080 127.0.0.1:30151" --HiddenServicePort "5900 127.0.0.1:30834" --HiddenServicePort "3389 127.0.0.1:3389"
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
the following user processes:
- ZONEALARM.EXE
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
Modifies file system :
Creates the following files:
- %APPDATA%\tor\hidden_service\private_key.tmp
- %APPDATA%\tor\hidden_service\hostname.tmp
- %APPDATA%\Epta\iwep.exe
- %APPDATA%\tor\state.tmp
Moves the following files:
- from %APPDATA%\tor\hidden_service\hostname.tmp to %APPDATA%\tor\hidden_service\hostname
- from %APPDATA%\tor\hidden_service\private_key.tmp to %APPDATA%\tor\hidden_service\private_key
- from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state
Network activity:
Connects to:
- '76.##.17.194':9090
- '17#.#5.193.9':80
- '21#.#12.245.170':443
- 'localhost':9050
- 'ch####p.dyndns.org':80
- 'localhost':1039
TCP:
HTTP GET requests:
- ch####p.dyndns.org/
UDP:
- DNS ASK ch####p.dyndns.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
