Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] '1999851' = '{4A6D4E96-7240-4D19-8654-E2F73B19F0E9}'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] '1985103' = '{4A6D4E96-7240-4D19-8654-E2F73B19F0E9}'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{4A6D4E96-7240-4D19-8654-E2F73B19F0E9}' = ''
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\NetCreate1] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\ywmcsb.exe' = '<SYSTEM32>\ywmcsb.exe:*:Enabled:QVOD'
Creates and executes the following:
- '<SYSTEM32>\sbttt.exe'
- '<SYSTEM32>\buttons.exe'
- '<SYSTEM32>\ywmcsb.exe'
- '<SYSTEM32>\SVCHTOS.exe'
- '<SYSTEM32>\buttons.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\Deleteme.bat
- '<SYSTEM32>\svchost.exe' -K NETSVCS
Modifies file system :
Creates the following files:
- <DRIVERS>\lpk.sys
- %PROGRAM_FILES%\Windows Media Player\lpk.dll
- <SYSTEM32>\Deleteme.bat
- <SYSTEM32>\buttons.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\2[1].exe
- %TEMP%\268203_Index.TEMP
- <SYSTEM32>\SVCHTOS.exe
- <SYSTEM32>\ywmcsb.exe
- <SYSTEM32>\sbttt.exe
- %PROGRAM_FILES%\Internet Explorer\lpk.dll
- <SYSTEM32>\Msenfi515.dll
Sets the 'hidden' attribute to the following files:
- %PROGRAM_FILES%\Windows Media Player\lpk.dll
- <DRIVERS>\lpk.sys
- C:\Documents and Settings\LocalService\NetCreate.dll
- <SYSTEM32>\Msenfi515.dll
- %PROGRAM_FILES%\Internet Explorer\lpk.dll
Deletes the following files:
- <SYSTEM32>\sbttt.exe
Moves the following files:
- from %TEMP%\268203_Index.TEMP to C:\Documents and Settings\LocalService\NetCreate.dll
Network activity:
Connects to:
- 'cw###.3322.org':6016
- 'ag###.qvod.com':80
- '96.##.165.248':80
- 'up###e.qvod.com':80
- 'localhost':1070
TCP:
HTTP GET requests:
- 96.##.165.248/windows/2.exe
- up###e.qvod.com/qd.jpg
UDP:
- DNS ASK ag###.qvod.com
- DNS ASK st####.sipphone.com
- DNS ASK st##.qvod.com
- DNS ASK cw###.3322.org
- DNS ASK up###e.qvod.com
- DNS ASK tr###.qvod.com
- 'localhost':1061
- 'localhost':1062
- 'localhost':1063
- 'localhost':1060
- 'localhost':1057
- 'localhost':1059
- 'localhost':1058
- 'localhost':1064
- 'st##.qvod.com':3478
- 'st####.sipphone.com':3478
- 'tr###.qvod.com':80
- 'localhost':1068
- 'localhost':1065
- 'localhost':1066
- 'localhost':1067
- 'localhost':1045
- 'localhost':1044
- 'localhost':1047
- 'localhost':1046
- 'localhost':1043
- 'localhost':1040
- '23#.#55.255.250':1900
- 'localhost':1042
- 'localhost':1041
- 'localhost':1054
- 'localhost':1053
- 'localhost':1056
- 'localhost':1055
- 'localhost':1052
- 'localhost':1049
- 'localhost':1048
- 'localhost':1051
- 'localhost':1050
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
