Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %LOCALAPPDATA%\start\update_backup.exe
- %LOCALAPPDATA%\start\rcx87cf.tmp
Infects the following executable files
- <Drive name for removable media>:\winmine_backup.exe
Creates the following files on removable media
- <Drive name for removable media>:\bloc-notes.exe
- <Drive name for removable media>:\winmine_backup.exe
- <Drive name for removable media>:\rcx3f0b.tmp
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Modifies file system
Creates the following files
- %TEMP%\lc.resources
- %TEMP%\pi3v2_js.out
- %TEMP%\pi3v2_js.cmdline
- %TEMP%\pi3v2_js.0.vb
- %TEMP%\giz.resources
- %TEMP%\mlswkgs.resources
- %TEMP%\windowsupdate.ico
- %TEMP%\res84e2.tmp
- %TEMP%\vbc84c2.tmp
- %TEMP%\m5pqzjqj.out
- %TEMP%\m5pqzjqj.cmdline
- %TEMP%\m5pqzjqj.0.vb
- %TEMP%\whatdafock.txt
- %TEMP%\girbumefo.resources
- %TEMP%\pxy.resources
- %TEMP%\pt9jlmv-.exe
- %TEMP%\res7c95.tmp
- %TEMP%\vbc7c94.tmp
- %TEMP%\pt9jlmv-.out
- %TEMP%\pt9jlmv-.cmdline
- %TEMP%\pt9jlmv-.0.vb
- %TEMP%\msnpsharp.dll
- %TEMP%\n7ns5fro.resources
- %LOCALAPPDATA%\start\update.exe
- %TEMP%\svchost.exe
- %TEMP%\update.exe
- %TEMP%\vbc26fd.tmp
- %TEMP%\res270e.tmp
Deletes the following files
- %TEMP%\res7c95.tmp
- %TEMP%\pi3v2_js.0.vb
- %TEMP%\pi3v2_js.cmdline
- %TEMP%\pi3v2_js.out
- %TEMP%\vbc26fd.tmp
- %TEMP%\res270e.tmp
- %LOCALAPPDATA%\start\update.exe
- %TEMP%\windowsupdate.ico
- %TEMP%\girbumefo.resources
- %TEMP%\pxy.resources
- %TEMP%\m5pqzjqj.0.vb
- %TEMP%\m5pqzjqj.out
- %TEMP%\m5pqzjqj.cmdline
- %TEMP%\vbc84c2.tmp
- %TEMP%\res84e2.tmp
- %TEMP%\pt9jlmv-.exe
- %TEMP%\pt9jlmv-.cmdline
- %TEMP%\pt9jlmv-.0.vb
- %TEMP%\pt9jlmv-.out
- %TEMP%\vbc7c94.tmp
- %TEMP%\mlswkgs.resources
- %TEMP%\giz.resources
Substitutes the following executable files
- <Drive name for removable media>:\winmine.exe
Substitutes the following files
- %TEMP%\windowsupdate.ico
Network activity
Connects to
- '17#.#3.169.14':80
Miscellaneous
Creates and executes the following
- '%TEMP%\update.exe'
- '%TEMP%\svchost.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pt9jlmv-.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7C95.tmp" "%TEMP%\vbc7C94.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\m5pqzjqj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES84E2.tmp" "%TEMP%\vbc84C2.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pi3v2_js.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES270E.tmp" "%TEMP%\vbc26FD.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pt9jlmv-.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7C95.tmp" "%TEMP%\vbc7C94.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\m5pqzjqj.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES84E2.tmp" "%TEMP%\vbc84C2.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\pi3v2_js.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES270E.tmp" "%TEMP%\vbc26FD.tmp"
