Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DualDesk' = '"C:\DD19068\DualDesk.exe" -SHOWICON'
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\ddTimer.lnk
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\dualdesk] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\DD19068\DualDesk.exe' = 'C:\DD19068\DualDesk.exe:*:Enabled:DualDesk-Server'
Creates and executes the following:
- C:\DD19068\ddTimer.exe
- C:\DD19068\DualDesk.exe -SERVICE
- C:\DD19068\DualDesk.exe -SHOWICON
- C:\DD19068\DualDesk.exe -autoconnect
- %TEMP%\7zS1.tmp\ddp.help-key.com_443.exe /403750-
- %TEMP%\nse4.tmp\ns5.tmp "netsh.exe" firewall add allowedprogram "C:\DD19068\DualDesk.exe" "DualDesk-Server" ENABLE ALL
- %TEMP%\nse4.tmp\ns6.tmp "netsh.exe" firewall add allowedprogram "C:\DD19068\DualDesk.exe" "DualDesk-Server" ENABLE
Executes the following:
- <SYSTEM32>\net1.exe start dualdesk
- <SYSTEM32>\netsh.exe firewall add allowedprogram "C:\DD19068\DualDesk.exe" "DualDesk-Server" ENABLE
- <SYSTEM32>\netsh.exe firewall add allowedprogram "C:\DD19068\DualDesk.exe" "DualDesk-Server" ENABLE ALL
Modifies file system :
Creates the following files:
- %TEMP%\7zS1.tmp\ddTools\User.log
- C:\DD19068\DualDesk.exe
- C:\DD19068\VRS.exe
- C:\DD19068\rc4.key
- C:\DD19068\ddTimer.exe
- C:\DD19068\ddTools.ini
- %TEMP%\nse4.tmp\ns5.tmp
- %TEMP%\nse4.tmp\ns6.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\74a10fa916583329cf9db147338ea85f_23ef5514-3059-436f-a4a7-4cefaab20eb1
- C:\DD19068\rePaper.exe
- C:\DD19068\DDrelay.bat
- %TEMP%\nse4.tmp\nsExec.dll
- C:\DD19068\MSRC4PLG.dsm
- %TEMP%\7zS1.tmp\rc4.key
- %TEMP%\7zS1.tmp\Splash.bmp
- %TEMP%\7zS1.tmp\ddTimer.exe
- %TEMP%\7zS1.tmp\DDopts.dat
- %TEMP%\7zS1.tmp\ddTools.ini
- %TEMP%\7zS1.tmp\MSRC4PLG.dsm
- C:\DD19068\Uninst.exe
- %TEMP%\nse4.tmp\default.bmp
- %TEMP%\nse4.tmp\splash.dll
- %TEMP%\7zS1.tmp\ddp.help-key.com_443.exe
- %TEMP%\nso3.tmp
- C:\DD19068\Licensed.to
Deletes the following files:
- %TEMP%\7zS1.tmp\ddTools.ini
- %TEMP%\nse4.tmp\ns5.tmp
- %TEMP%\nse4.tmp\ns6.tmp
- %TEMP%\7zS1.tmp\ddTimer.exe
- %TEMP%\7zS1.tmp\DDopts.dat
- %TEMP%\7zS1.tmp\MSRC4PLG.dsm
- %TEMP%\7zS1.tmp\rc4.key
Network activity:
Connects to:
- 'dd#.##lp-key.com':443
UDP:
- DNS ASK dd#.##lp-key.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'DualDesk Tray Icon' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: ''
