Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'mshta.exe vbscript:CreateObject("Wscript.Shell").run("<Drive name for removable media>:\\\\\RECYCLERNNKH\\70F6E465-7DEF-71d2-C2D9-10C04F8EEC81.vbe../")(window.close)'
Creates the following files on removable media:
- <Drive name for removable media>:\RECYCLERNNKH\inj.dat
- <Drive name for removable media>:\RECYCLERNNKH\taobao.ico
- <Drive name for removable media>:\RECYCLERNNKH\tmp.reg
- <Drive name for removable media>:\RECYCLERNNKH\70F6E465-7DEF-71d2-C2D9-10C04F8EEC81.vbe
- <Drive name for removable media>:\RECYCLERNNKH\bagua.ico
- <Drive name for removable media>:\RECYCLERNNKH\kiping.exe
- <Drive name for removable media>:\RECYCLERNNKH\meinv.ico
- <Drive name for removable media>:\RECYCLERNNKH\kankan.ico
Malicious functions:
Creates and executes the following:
- <Drive name for removable media>:\RECYCLERNNKH\kiping.exe
- "%TEMP%\LavaGame_2.2.exe" (downloaded from the Internet)
- "%TEMP%\Loader_forqd312.exe" (downloaded from the Internet)
- "%TEMP%\jm_setup_qvod.exe" (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\regedt32.exe /s <Drive name for removable media>:\RECYCLERNNKH\tmp.reg
- <SYSTEM32>\msiexec.exe -Embedding 15DCDC8927B7D0DC181BC7855EFCAA1C
- <SYSTEM32>\attrib.exe +s +h <Drive name for removable media>:\RECYCLERNNKH
- %WINDIR%\regedit.exe /s <Drive name for removable media>:\RECYCLERNNKH\tmp.reg
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.cn###kan.com/?t
- <SYSTEM32>\expand.exe ""%TEMP%\favorites_url.cab"" -F:*.* "%HOMEPATH%\Favorites"
- <SYSTEM32>\msiexec.exe /i ""%TEMP%\ins1.tmp.msi"" /quiet
- <SYSTEM32>\cmd.exe /c """%TEMP%\run_kl_file.bat"" "
- <SYSTEM32>\msiexec.exe /V
- <SYSTEM32>\cmd.exe /c """%TEMP%\tmp_ext_favurl_cab.bat"" "
- <SYSTEM32>\cmd.exe /c """%TEMP%\run_dws_file.bat"" "
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Modifies file system :
Creates the following files:
- %APPDATA%\ampw.ooe.ini
- C:\Config.Msi\2292c.rbs
- %TEMP%\71628.vbs
- %HOMEPATH%\Favorites\їґїґµзУ°.url
- %CommonProgramFiles%\lanmao.dll
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\Loader_forqd312.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\LavaGame_2.2[1].exe
- %TEMP%\LavaGame_2.2.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\jm_setup_qvod[1].exe
- %TEMP%\jm_setup_qvod.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\Loader_forqd312[1].exe
- %HOMEPATH%\Favorites\°Щ№ИµзУ°.url
- %TEMP%\ins1.tmp.msi
- %TEMP%\inl2.tmp
- %WINDIR%\Installer\22929.msi
- %TEMP%\cdf1912.tmp
- %TEMP%\run_kl_file.bat
- %CommonProgramFiles%\loader.dll
- %HOMEPATH%\Favorites\°ЛШФЙ«Нј.url
- %HOMEPATH%\Favorites\ґґТµН¶ЧКєГПоДї.url
- %HOMEPATH%\Favorites\ГАЕ®АЦФ°.url
- %TEMP%\run_dws_file.bat
- %TEMP%\favorites_url.cab
- %TEMP%\tmp_ext_favurl_cab.bat
Deletes the following files:
- %WINDIR%\Installer\MSI3.tmp
Deletes itself.
Network activity:
Connects to:
- 'localhost':1039
- 'do####ad.lava.cn':80
- 'www.cn###kan.com':80
- 'www.xu###i100.com':80
- 'localhost':1035
- 'ju###.35638.com':27889
- 'bo###gqi.6gg.cn':80
TCP:
HTTP GET requests:
- www.cn###kan.com/?t
- www.xu###i100.com/msn/software/partner/28/DDHYT.exe
- do####ad.lava.cn/GAME/36/LavaGame_2.2.exe
- bo###gqi.6gg.cn/jm_setup_qvod.exe
- www.xu###i100.com/msn/software/partner/s/Loader_forqd312.exe
UDP:
- DNS ASK do####ad.lava.cn
- DNS ASK www.cn###kan.com
- DNS ASK www.xu###i100.com
- DNS ASK ju###.35638.com
- DNS ASK bo###gqi.6gg.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
