Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSecurityHealthService' = 'C:\Users\Public\AppData\ie.vbs'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\AppData\ie.vbs"
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -Embedding
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v "WindowsSecurityHealthService" /t REG_SZ /d "C:\Users\Public\AppData\ie.vbs" /f
- '<SYSTEM32>\cmd.exe' /c ""C:\Users\Public\AppData\regedit.bat" "
Modifies file system:
Creates the following files:
- C:\Users\Public\AppData\ie.vbs
- C:\Users\Public\AppData\regedit.bat
Network activity:
Connects to:
- 'localhost':1037
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
