Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\HipsDdemon] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\HipsDdemon] 'ImagePath' = '<SYSTEM32>\HipsDdemon.exe -auto'
- [<HKLM>\System\CurrentControlSet\Services\Bcdefg] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Bcdefg] 'ImagePath' = '%WINDIR%\svchost.exe'
- [<HKLM>\System\CurrentControlSet\Services\WpnService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WpnService] 'ImagePath' = '%WINDIR%\zqbzqy.exe'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\QAssist] 'Start' = '00000001'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\QAssist] 'ImagePath' = 'system32\DRIVERS\QAssist.sys'
- [<HKLM>\System\CurrentControlSet\Services\services] 'Start' = '00000002'
Creates the following services
- 'HipsDdemon' <SYSTEM32>\HipsDdemon.exe -auto
- 'Bcdefg' %WINDIR%\svchost.exe
- 'WpnService' %WINDIR%\zqbzqy.exe
- 'services' <SYSTEM32>\services.exe
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\svchost.exe
Registers file system filter
- [<HKLM>\SYSTEM\CurrentControlSet\Services\QAssist] 'Group' = 'FSFilter Activity Monitor'
Modifies file system
Creates the following files
- %TEMP%\guid��ȡ.exe
- %TEMP%\hipsdaemon.exe
- %TEMP%\wininit.exe
- %TEMP%\libeay32.dll
- %TEMP%\winlogon.exe
- %TEMP%\services.exe
- %WINDIR%\syswow64\hipsddemon.exe
- %TEMP%\svchost.exe
- %TEMP%\sin.ini
- %WINDIR%\svchost.exe
- %WINDIR%\syswow64\hfblddel.bat
- %WINDIR%\zqbzqy.exe
- <DRIVERS>\qassist.sys
- %WINDIR%\syswow64\services.exe
- nul
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\services.exe
Deletes the following files
- %TEMP%\hipsdaemon.exe
- %TEMP%\winlogon.exe
Moves the following files
- from %TEMP%\wininit.exe to %WINDIR%\syswow64\1198930.bak
- from %TEMP%\svchost.exe to %WINDIR%\syswow64\1200911.bak
Network activity
Connects to
- '11#.#26.74.16':433
- '11#.#26.74.16':8090
- '11#.#26.74.16':4980
- '11#.#26.74.16':23658
TCP
Other
- '11#.#26.74.16':433
- '11#.#26.74.16':8090
- '11#.#26.74.16':4980
- '11#.#26.74.16':23658
Miscellaneous
Searches for the following windows
- ClassName: 'CTXOPConntion_Class' WindowName: ''
Creates and executes the following
- '%TEMP%\guid��ȡ.exe'
- '%TEMP%\hipsdaemon.exe'
- '%TEMP%\wininit.exe'
- '%TEMP%\winlogon.exe'
- '%TEMP%\services.exe'
- '%WINDIR%\syswow64\hipsddemon.exe' -auto
- '%WINDIR%\syswow64\hipsddemon.exe' -acsi
- '%TEMP%\svchost.exe'
- '%WINDIR%\svchost.exe'
- '%WINDIR%\zqbzqy.exe'
- '%WINDIR%\zqbzqy.exe' Win7
- '%WINDIR%\svchost.exe' Win7
- '%WINDIR%\syswow64\services.exe'
- '%WINDIR%\syswow64\services.exe' Win7
- '%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\hfblddel.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 2 127.0.0.1 > nul && del %TEMP%\winlogon.exe > nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\hfblddel.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ping -n 2 127.0.0.1 > nul && del %TEMP%\winlogon.exe > nul
- '%WINDIR%\syswow64\ping.exe' -n 2 127.0.0.1
