Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run] 'CCProxy' = '%WINDIR%\Fonts\wbem\svchost.exe'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\NVIDIA] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NVIDIA] 'ImagePath' = '%WINDIR%\Fonts\wbem\svchost.exe -service'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="AhnLab V3 Service" protocol=TCP dir=in localport=1726,8888 action=allow
Modifies file system
Creates the following files
- %WINDIR%\fonts\wbem\history.txt
- %WINDIR%\fonts\wbem\language\rom.ini
- %WINDIR%\fonts\wbem\language\rus.ini
- %WINDIR%\fonts\wbem\language\sve.ini
- %WINDIR%\fonts\wbem\language\trk.ini
- %WINDIR%\fonts\wbem\web\accinfo.htm
- %WINDIR%\fonts\wbem\web\authinfo-account.htm
- %WINDIR%\fonts\wbem\web\authinfo-content.htm
- %WINDIR%\fonts\wbem\web\authinfo-site.htm
- %WINDIR%\fonts\wbem\web\cn_acclistadmin.htm
- %WINDIR%\fonts\wbem\web\cn_acclistuser.htm
- %WINDIR%\fonts\wbem\web\en_acclistadmin.htm
- %WINDIR%\fonts\wbem\web\en_acclistuser.htm
- %WINDIR%\fonts\wbem\web\proxyadmin.php
- %WINDIR%\fonts\wbem\accinfo.ini
- %WINDIR%\fonts\wbem\install.reg
- %WINDIR%\fonts\wbem\language\ptb.ini
- %WINDIR%\fonts\wbem\install.bat
- %WINDIR%\fonts\wbem\language\nld.ini
- %WINDIR%\fonts\wbem\language\language.ini
- %WINDIR%\fonts\wbem\lefttime.ini
- %WINDIR%\fonts\wbem\svchost.exe
- %WINDIR%\fonts\wbem\language\ara.ini
- %WINDIR%\fonts\wbem\language\bgr.ini
- %WINDIR%\fonts\wbem\language\chs.ini
- %WINDIR%\fonts\wbem\language\cht.ini
- %WINDIR%\fonts\wbem\language\csy.ini
- %WINDIR%\fonts\wbem\language\deu.ini
- %WINDIR%\fonts\wbem\language\enu.ini
- %WINDIR%\fonts\wbem\language\esp.ini
- %WINDIR%\fonts\wbem\language\fra.ini
- %WINDIR%\fonts\wbem\language\heb.ini
- %WINDIR%\fonts\wbem\language\hun.ini
- %WINDIR%\fonts\wbem\language\ita.ini
- %WINDIR%\fonts\wbem\language\jpn.ini
- %WINDIR%\fonts\wbem\language\language.xml
- %WINDIR%\fonts\wbem\ccproxy.ini
Network activity
Connects to
- 'ya##o.com':80
UDP
- DNS ASK ya##o.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'svchost' WindowName: ''
Creates and executes the following
- '%WINDIR%\fonts\wbem\svchost.exe' -service
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Fonts\wbem\install.bat" "
- '%WINDIR%\syswow64\sc.exe' create "NVIDIA" binpath= "%WINDIR%\Fonts\wbem\svchost.exe -service" type= own type= interact start= auto
- '%WINDIR%\syswow64\sc.exe' config "NVIDIA" displayname= "NVIDIA Display Driver Service"
- '%WINDIR%\syswow64\sc.exe' description NVIDIA "Provides system and desktop level support to the NVIDIA display driver."
- '%WINDIR%\syswow64\sc.exe' config ShellHWDetection depend= NVIDIA
- '%WINDIR%\syswow64\sc.exe' start "NVIDIA"
