Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Local' = '%APPDATA%\Wd\wauctl.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Local' = '%APPDATA%\Wd\wauctl.exe'
Malicious functions:
Creates and executes the following:
- %TEMP%\tmp1763wauclt.exe (downloaded from the Internet)
- %TEMP%\732ShareCash_Downloader_Pro_v2.0.exe
Executes the following:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:"%TEMP%\RES3.tmp"" "%TEMP%\CSC2.tmp"
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe /noconfig /fullpaths @"%TEMP%\pprigj7e.cmdline"
Modifies file system :
Creates the following files:
- %TEMP%\tmp1763wauclt.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\9db6b5d1f864ae66305fd0b10f981322_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1275210071-117609710-1801674531-500\997f7636c48997b35067d00be6288d5c_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1275210071-117609710-1801674531-500\253ceeaa8cfe78f5bafdb7e162dc1149_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\google[1]
- %TEMP%\dclogs.sys
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\a2427f1a-dbd9-48a9-b9dc-b67ee4569aa1
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\Preferred
- %APPDATA%\Microsoft\Protect\S-1-5-21-1275210071-117609710-1801674531-500\ad1e8824-967c-458b-95fe-516b5ae4e66b
- %TEMP%\pprigj7e.0.cs
- %TEMP%\pprigj7e.cmdline
- %APPDATA%\Wd\wauctl.exe
- %TEMP%\732ShareCash_Downloader_Pro_v2.0.exe
- %TEMP%\RES3.tmp
- %TEMP%\pprigj7e.dll
- %TEMP%\pprigj7e.out
- %TEMP%\CSC2.tmp
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Wd\wauctl.exe
Deletes the following files:
- %TEMP%\pprigj7e.cmdline
- %TEMP%\pprigj7e.0.cs
- %TEMP%\pprigj7e.dll
- %TEMP%\RES3.tmp
- %TEMP%\CSC2.tmp
- %TEMP%\pprigj7e.out
Network activity:
Connects to:
- 'localhost':1040
- '74.##5.232.51':80
- 'dl.##opbox.com':80
- 'du#####ite.no-ip.org':1699
TCP:
HTTP GET requests:
- 74.##5.232.51/
- dl.##opbox.com/u/23042836/wauclt.exe
UDP:
- DNS ASK www.google.com
- DNS ASK du#####ite.no-ip.org
- DNS ASK dl.##opbox.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
