Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\CLSID\{98641F47-8C25-4936-BEE4-C2CE1298969D}\Shell\Open\command] '' = 'Control Userpasswords2'
- [<HKLM>\SOFTWARE\Classes\*\shell\open\command] '' = 'notepad.exe %1'
- [<HKLM>\SOFTWARE\Classes\hta_auto_file\shell\open\command] '' = '"<SYSTEM32>\mshta.exe" "%1"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\SENS] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\seclogon] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SamSs] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\TrkWks] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\winmgmt] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Themes] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ShellHWDetection] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Spooler] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\RpcSs] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Dhcp] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Dnscache] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\DcomLaunch] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\AudioSrv] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Browser] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\lanmanworkstation] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ProtectedStorage] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\lanmanserver] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Eventlog] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\HidServ] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '<SYSTEM32>\sc.exe' config seclogon start= auto
- '<SYSTEM32>\sc.exe' config SENS start= auto
- '<SYSTEM32>\sc.exe' config Schedule start= auto
- '<SYSTEM32>\sc.exe' config SamSs start= auto
- '<SYSTEM32>\sc.exe' config SCardSvr start= disabled
- '<SYSTEM32>\sc.exe' config srservice start= demand
- '<SYSTEM32>\sc.exe' config SSDPSRV start= disabled
- '<SYSTEM32>\sc.exe' config Spooler start= auto
- '<SYSTEM32>\sc.exe' config SharedAccess start= auto
- '<SYSTEM32>\sc.exe' config ShellHWDetection start= auto
- '<SYSTEM32>\sc.exe' config RSVP start= disabled
- '<SYSTEM32>\sc.exe' config RasAuto start= disabled
- '<SYSTEM32>\sc.exe' config RasMan start= demand
- '<SYSTEM32>\sc.exe' config ProtectedStorage start= auto
- '<SYSTEM32>\sc.exe' config PlugPlay start= demand
- '<SYSTEM32>\sc.exe' config PolicyAgent start= disabled
- '<SYSTEM32>\sc.exe' config RpcLocator start= disabled
- '<SYSTEM32>\sc.exe' config RpcSs start= auto
- '<SYSTEM32>\sc.exe' config RemoteRegistry start= disabled
- '<SYSTEM32>\sc.exe' config RDSessMgr start= demand
- '<SYSTEM32>\sc.exe' config RemoteAccess start= disabled
- '<SYSTEM32>\sc.exe' config stisvc start= demand
- '<SYSTEM32>\sc.exe' config Wmi start= disabled
- '<SYSTEM32>\sc.exe' config WmiApSrv start= disabled
- '<SYSTEM32>\sc.exe' config WmdmPmSN start= disabled
- '<SYSTEM32>\sc.exe' config WebClient start= disabled
- '<SYSTEM32>\sc.exe' config winmgmt start= auto
- '<SYSTEM32>\sc.exe' config xmlprov start= disabled
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v AUOptions /d 00000002 /t REG_DWORD /f
- '<SYSTEM32>\sc.exe' config WZCSVC start= demand
- '<SYSTEM32>\sc.exe' config wscsvc start= disabled
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' config W32Time start= disabled
- '<SYSTEM32>\sc.exe' config TermService start= demand
- '<SYSTEM32>\sc.exe' config Themes start= auto
- '<SYSTEM32>\sc.exe' config TapiSrv start= demand
- '<SYSTEM32>\sc.exe' config SwPrv start= demand
- '<SYSTEM32>\sc.exe' config SysmonLog start= disabled
- '<SYSTEM32>\sc.exe' config UPS start= demand
- '<SYSTEM32>\sc.exe' config VSS start= disabled
- '<SYSTEM32>\sc.exe' config upnphost start= disabled
- '<SYSTEM32>\sc.exe' config TlntSvr start= disabled
- '<SYSTEM32>\sc.exe' config TrkWks start= auto
- '<SYSTEM32>\sc.exe' config dmadmin start= demand
- '<SYSTEM32>\sc.exe' config dmserver start= demand
- '<SYSTEM32>\sc.exe' config Dhcp start= auto
- '<SYSTEM32>\sc.exe' config CryptSvc start= disabled
- '<SYSTEM32>\sc.exe' config DcomLaunch start= auto
- '<SYSTEM32>\sc.exe' config ERSvc start= disabled
- '<SYSTEM32>\sc.exe' config Eventlog start= auto
- '<SYSTEM32>\sc.exe' config EapHost start= demand
- '<SYSTEM32>\sc.exe' config Dnscache start= auto
- '<SYSTEM32>\sc.exe' config Dot3svc start= demand
- '<SYSTEM32>\sc.exe' config COMSysApp start= disabled
- '<SYSTEM32>\sc.exe' config ALG start= demand
- '<SYSTEM32>\sc.exe' config AppMgmt start= disabled
- '<SYSTEM32>\sc.exe' config Alerter start= disabled
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\setup.cmd" "
- '%WINDIR%\regedit.exe' /s tweaks.reg
- '<SYSTEM32>\sc.exe' config cisvc start= disabled
- '<SYSTEM32>\sc.exe' config ClipSrv start= disabled
- '<SYSTEM32>\sc.exe' config Browser start= auto
- '<SYSTEM32>\sc.exe' config AudioSrv start= auto
- '<SYSTEM32>\sc.exe' config BITS start= demand
- '<SYSTEM32>\sc.exe' config EventSystem start= demand
- '<SYSTEM32>\sc.exe' config NetDDE start= disabled
- '<SYSTEM32>\sc.exe' config NetDDEdsdm start= disabled
- '<SYSTEM32>\sc.exe' config napagent start= demand
- '<SYSTEM32>\sc.exe' config MSDTC start= disabled
- '<SYSTEM32>\sc.exe' config MSIServer start= demand
- '<SYSTEM32>\sc.exe' config NtLmSsp start= disabled
- '<SYSTEM32>\sc.exe' config NtmsSvc start= demand
- '<SYSTEM32>\sc.exe' config Nla start= demand
- '<SYSTEM32>\sc.exe' config Netlogon start= disabled
- '<SYSTEM32>\sc.exe' config Netman start= demand
- '<SYSTEM32>\sc.exe' config mnmsrvc start= disabled
- '<SYSTEM32>\sc.exe' config hkmsvc start= demand
- '<SYSTEM32>\sc.exe' config HTTPFilter start= demand
- '<SYSTEM32>\sc.exe' config HidServ start= auto
- '<SYSTEM32>\sc.exe' config FastUserSwitchingCompatibility start= disabled
- '<SYSTEM32>\sc.exe' config helpsvc start= disabled
- '<SYSTEM32>\sc.exe' config LmHosts start= disabled
- '<SYSTEM32>\sc.exe' config Messenger start= disabled
- '<SYSTEM32>\sc.exe' config lanmanworkstation start= auto
- '<SYSTEM32>\sc.exe' config ImapiService start= demand
- '<SYSTEM32>\sc.exe' config lanmanserver start= auto
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoUserNameInStartMenu' = '00000000'
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1004' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'RunInvalidSignatures' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\RarSFX0\tweaks.reg
- %TEMP%\RarSFX0\setup.cmd
Deletes the following files:
- %TEMP%\RarSFX0\tweaks.reg
- %TEMP%\RarSFX0\setup.cmd
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
