Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Chrome' = 'c:\11181481\wmfihd.pif c:\11181481\nbosqsk.qvp'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'AutoUpdate' = 'c:\11181481\Update.vbs'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'UDP Subsystem' = '%ProgramFiles(x86)%\UDP Subsystem\udpss.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\udp subsystem
- <SYSTEM32>\tasks\udp subsystem task
Malicious functions
Injects code into
the following user processes:
- regsvcs.exe
Modifies file system
Creates the following files
- C:\11181481\cptrpfnttk.pdf
- C:\11181481\prtqli.bin
- C:\11181481\tnbi.bin
- C:\11181481\gfdsxgnwnm.pdf
- C:\11181481\doskij.log
- C:\11181481\gafqwqa.ico
- C:\11181481\rqrwi.xls
- C:\11181481\ihqfwfonnd.bin
- C:\11181481\aidgj.bmp
- C:\11181481\update.vbs
- %TEMP%\regsvcs.exe
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\run.dat
- %ProgramFiles(x86)%\udp subsystem\udpss.exe
- %TEMP%\tmp3be7.tmp
- C:\11181481\kpam.docx
- %HOMEPATH%\temp\cptrpfnttk.pdf
- C:\11181481\lxtvwwpej.mp3
- C:\11181481\hqsvelejb.dll
- C:\11181481\wvgdhuvc.bin
- C:\11181481\wmfihd.pif
- C:\11181481\becwwqqvss.jpg
- C:\11181481\rqgnm.bin
- C:\11181481\nlvdragd.xml
- C:\11181481\dcgoha.cpl
- C:\11181481\rkupgtmhw.xml
- C:\11181481\nbosqsk.qvp
- C:\11181481\hsknqrgl.ppt
- C:\11181481\uskqxqww.ini
- C:\11181481\vttq.xml
- C:\11181481\lthx.ico
- C:\11181481\tacpaplhb.ppt
- C:\11181481\ewwecbvfm.ini
- C:\11181481\jtibj.bin
- C:\11181481\jnfwxx.icm
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\task.dat
- %TEMP%\tmp3e87.tmp
Sets the 'hidden' attribute to the following files
- C:\11181481\wmfihd.pif
Deletes the following files
- %TEMP%\tmp3be7.tmp
- %TEMP%\tmp3e87.tmp
Network activity
Connects to
- '79.##4.225.40':48154
UDP
- DNS ASK st####odss.ddns.net
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\11181481\wmfihd.pif' nbosqsk.qvp
- '%TEMP%\regsvcs.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "UDP Subsystem" /xml "%TEMP%\tmp3BE7.tmp"
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "UDP Subsystem Task" /xml "%TEMP%\tmp3E87.tmp"
