Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\WinHelp32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WinHelp32] 'ImagePath' = '<SYSTEM32>\swgswq.exe'
Malicious functions
Installs hooks to intercept notifications
on window messages:
- Handler for all processes: %TEMP%\qvbDBA1.tmp
- Handler for all processes: %WINDIR%\TEMP\hwbDC4D.tmp
Modifies file system
Creates the following files
- %TEMP%\qvbdba1.tmp
- %WINDIR%\syswow64\swgswq.exe
- %WINDIR%\temp\hwbdc4d.tmp
Deletes itself.
Network activity
UDP
- DNS ASK om###ubs.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\swgswq.exe'
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul
