Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Microsoft Connection Manager' = '%HOMEPATH%\Local Settings\Application Data\cmstp.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Sessmgr' = '%APPDATA%\Microsoft\sessmgr.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'DCOM' = '%HOMEPATH%\Local Settings\Application Data\Microsoft\Windows\dllhost.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'cisvc' = '%HOMEPATH%\Local Settings\Application Data\cisvc.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '<DRIVERS>\mstinit.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '%ProgramFiles%\cisvc.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Spooler' = '%PROGRAMDATA%\spoolsv.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'IEudInit' = '<DRIVERS>\ieudinit.exe'
Modifies file system
Creates the following files
- %TEMP%\twain002.mtx
- %PROGRAMDATA%\rcx993a.tmp
- %PROGRAMDATA%\spoolsv.exe
- %ProgramFiles%\rcx97e2.tmp
- %ProgramFiles%\cisvc.exe
- %WINDIR%\syswow64\drivers\rcx965a.tmp
- %WINDIR%\syswow64\drivers\mstinit.exe
- %WINDIR%\syswow64\drivers\ieudinit.exe
- %HOMEPATH%\local settings\application data\rcx9501.tmp
- %HOMEPATH%\local settings\application data\microsoft\windows\rcx9399.tmp
- %HOMEPATH%\local settings\application data\microsoft\windows\dllhost.exe
- %APPDATA%\Microsoft\rcx9146.tmp
- %APPDATA%\Microsoft\sessmgr.exe
- %HOMEPATH%\local settings\application data\rcx8f13.tmp
- %HOMEPATH%\local settings\application data\cmstp.exe
- %HOMEPATH%\local settings\application data\cisvc.exe
- %WINDIR%\syswow64\drivers\rcx9ab2.tmp
Moves the following files
- from %HOMEPATH%\local settings\application data\rcx8f13.tmp to %HOMEPATH%\local settings\application data\cmstp.exe
- from %APPDATA%\Microsoft\rcx9146.tmp to %APPDATA%\Microsoft\sessmgr.exe
- from %HOMEPATH%\local settings\application data\microsoft\windows\rcx9399.tmp to %HOMEPATH%\local settings\application data\microsoft\windows\dllhost.exe
- from %HOMEPATH%\local settings\application data\rcx9501.tmp to %HOMEPATH%\local settings\application data\cisvc.exe
- from %WINDIR%\syswow64\drivers\rcx965a.tmp to %WINDIR%\syswow64\drivers\mstinit.exe
- from %ProgramFiles%\rcx97e2.tmp to %ProgramFiles%\cisvc.exe
- from %PROGRAMDATA%\rcx993a.tmp to %PROGRAMDATA%\spoolsv.exe
- from %WINDIR%\syswow64\drivers\rcx9ab2.tmp to %WINDIR%\syswow64\drivers\ieudinit.exe
Network activity
TCP
HTTP GET requests
- http://www.ms###csi.com/ncsi.txt
UDP
- DNS ASK ly###s-db.org
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\local settings\application data\cmstp.exe' /c 30
- '%HOMEPATH%\local settings\application data\cmstp.exe' /c 85
- '%HOMEPATH%\local settings\application data\cmstp.exe' /r
- '%WINDIR%\syswow64\drivers\ieudinit.exe' /c 20
- '%HOMEPATH%\local settings\application data\cmstp.exe' /c 95
- '%HOMEPATH%\local settings\application data\cisvc.exe' /c 87
- '%WINDIR%\syswow64\drivers\ieudinit.exe' /c 97
- '%PROGRAMDATA%\spoolsv.exe' /c 65
- '%APPDATA%\Microsoft\sessmgr.exe' /c 99
- '%HOMEPATH%\local settings\application data\microsoft\windows\dllhost.exe' /c 75
- '%WINDIR%\syswow64\drivers\mstinit.exe' /c 31
- '%WINDIR%\syswow64\drivers\mstinit.exe' /c 89
- '%ProgramFiles%\cisvc.exe' /c 19
- '%HOMEPATH%\local settings\application data\cisvc.exe' /c 55
- '%HOMEPATH%\local settings\application data\microsoft\windows\dllhost.exe' /c 71
- '%PROGRAMDATA%\spoolsv.exe' /c 90
- '%APPDATA%\Microsoft\sessmgr.exe' /c 41
- '%ProgramFiles%\cisvc.exe' /c 24
- '%APPDATA%\Microsoft\sessmgr.exe' /c 99' (with hidden window)
- '%HOMEPATH%\local settings\application data\cisvc.exe' /c 87' (with hidden window)
- '%ProgramFiles%\cisvc.exe' /c 19' (with hidden window)
- '%HOMEPATH%\local settings\application data\microsoft\windows\dllhost.exe' /c 75' (with hidden window)
- '%PROGRAMDATA%\spoolsv.exe' /c 90' (with hidden window)
- '%HOMEPATH%\local settings\application data\cmstp.exe' /c 95' (with hidden window)
- '%HOMEPATH%\local settings\application data\cmstp.exe' /c 85' (with hidden window)
- '%WINDIR%\syswow64\drivers\mstinit.exe' /c 31' (with hidden window)
- '%WINDIR%\syswow64\drivers\mstinit.exe' /c 89' (with hidden window)
- '%PROGRAMDATA%\spoolsv.exe' /c 65' (with hidden window)
- '%ProgramFiles%\cisvc.exe' /c 24' (with hidden window)
- '%HOMEPATH%\local settings\application data\cisvc.exe' /c 55' (with hidden window)
- '%HOMEPATH%\local settings\application data\microsoft\windows\dllhost.exe' /c 71' (with hidden window)
- '%APPDATA%\Microsoft\sessmgr.exe' /c 41' (with hidden window)
- '%HOMEPATH%\local settings\application data\cmstp.exe' /c 30' (with hidden window)
- '%HOMEPATH%\local settings\application data\cmstp.exe' /r' (with hidden window)
- '%WINDIR%\syswow64\drivers\ieudinit.exe' /c 97' (with hidden window)
- '%WINDIR%\syswow64\drivers\ieudinit.exe' /c 20' (with hidden window)
