Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SynTPEnh' = '%HOMEPATH%\Local Settings\Microsoft\Windows\SynTPEnh.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Calculator' = '%HOMEPATH%\Local Settings\Microsoft\Calculator.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'app' = '%HOMEPATH%\Local Settings\app.exe'
Malicious functions:
Creates and executes the following:
- '%TEMP%\spoolsv.exe'
- '%TEMP%\wwl.exe'
- '%TEMP%\notepad.exe'
- '%TEMP%\services.exe'
- '%TEMP%\crss.exe'
Executes the following:
- '<SYSTEM32>\rundll32.exe' SHELL32.DLL,ShellExec_RunDLL "%TEMP%\spoolsv.exe"
- '<SYSTEM32>\rundll32.exe' SHELL32.DLL,ShellExec_RunDLL "%TEMP%\wwl.exe"
- '<SYSTEM32>\rundll32.exe' SHELL32.DLL,ShellExec_RunDLL "%TEMP%\crss.exe"
- '<SYSTEM32>\rundll32.exe' SHELL32.DLL,ShellExec_RunDLL "%TEMP%\notepad.exe"
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<-loopback>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:999'
Modifies file system :
Creates the following files:
- %TEMP%\276593.BXA
- %TEMP%\276671.BXA
- %TEMP%\276734.BXA
- %TEMP%\276218.dat
- %TEMP%\276328.BXA
- %TEMP%\276468.BXA
- %TEMP%\crss.exe
- %TEMP%\notepad.exe
- %TEMP%\spoolsv.exe
- %TEMP%\wwl.exe
- %HOMEPATH%\Local Settings\app.exe
- %HOMEPATH%\Local Settings\Microsoft\Calculator.exe
- %HOMEPATH%\Local Settings\Microsoft\Windows\SynTPEnh.exe
- %TEMP%\276223.dat
- %TEMP%\275630.dat
- %TEMP%\275625.dat
- %TEMP%\275708.dat
- %TEMP%\services.exe
- %TEMP%\275515.dat
- %HOMEPATH%\Local Settings\IconCache2.db
- %TEMP%\275703.dat
- %TEMP%\275843.dat
- %TEMP%\275958.dat
- %TEMP%\275953.dat
- %TEMP%\275770.dat
- %TEMP%\275765.dat
- %TEMP%\275848.dat
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Local Settings\Microsoft\Windows\SynTPEnh.exe
- %HOMEPATH%\Local Settings\Microsoft\Calculator.exe
- %HOMEPATH%\Local Settings\app.exe
Deletes the following files:
- %TEMP%\276223.dat
- %TEMP%\276218.dat
- %TEMP%\275958.dat
- %TEMP%\275953.dat
- %TEMP%\276328.BXA
- %TEMP%\276671.BXA
- %TEMP%\276734.BXA
- %TEMP%\276468.BXA
- %TEMP%\276593.BXA
- %TEMP%\275625.dat
- %TEMP%\275708.dat
- %TEMP%\275515.dat
- %TEMP%\275630.dat
- %TEMP%\275703.dat
- %TEMP%\275848.dat
- %TEMP%\275843.dat
- %TEMP%\275770.dat
- %TEMP%\275765.dat
Network activity:
Connects to:
- 'he###.#appyforever.com':5013
UDP:
- DNS ASK he###.#appyforever.com
