Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%APPDATA%\load_winupd.exe'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\winupd.exe' = '%APPDATA%\winupd.exe:*:Enabled:Windows Update'
Creates and executes the following:
- %APPDATA%\winupd.exe
- %APPDATA%\start_winupd.exe
Executes the following:
- <SYSTEM32>\taskkill.exe /im chrome.exe /f
- <SYSTEM32>\taskkill.exe /im iexplore.exe /f
- %WINDIR%\regedit.exe /s "%APPDATA%\addas.reg"
- %WINDIR%\regedit.exe /s "%APPDATA%\setproxy.reg"
- <SYSTEM32>\cmd.exe /C "%APPDATA%\setproxy.bat"
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="Windows Update" dir=out action=allow program="%APPDATA%\winupd.exe" enable=yes
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="Windows Update" dir=in action=allow program="%APPDATA%\winupd.exe" enable=yes
- <SYSTEM32>\taskkill.exe /im firefox.exe /f
- <SYSTEM32>\netsh.exe firewall add allowedprogram "%APPDATA%\winupd.exe" "Windows Update" ENABLE ALL
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- iexplore.exe
- firefox.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http://127.0.0.1:8008'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
Modifies file system :
Creates the following files:
- %TEMP%\exe9.tmp
- %TEMP%\exeA.tmp
- %TEMP%\exe7.tmp
- %TEMP%\exe8.tmp
- %APPDATA%\setproxy.reg
- %APPDATA%\addas.reg
- %APPDATA%\started.dat
- %APPDATA%\setproxy.bat
- %TEMP%\exe6.tmp
- %APPDATA%\libeay32-0.9.8-msvcrt.dll
- %TEMP%\exe1.tmp
- %APPDATA%\winupd.exe
- %APPDATA%\start_winupd.exe
- %TEMP%\exe4.tmp
- %TEMP%\exe5.tmp
- %TEMP%\exe2.tmp
- %TEMP%\exe3.tmp
Deletes the following files:
- %APPDATA%\addas.reg
- %APPDATA%\setproxy.reg
Network activity:
Connects to:
- '62.##2.74.193':80
TCP:
HTTP GET requests:
- 62.##2.74.193/tool/redirects.txt
- 62.##2.74.193/tool/getbanners.php
- 62.##2.74.193/tool/filters_v2.txt
- 62.##2.74.193/tool/filters_v2_css.txt
- 62.##2.74.193/tool/ntab.txt
HTTP POST requests:
- 62.##2.74.193/tool/getcmd.php
- 62.##2.74.193/tool/
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
