Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\PROCMON20] 'ImagePath' = '<DRIVERS>\PROCMON20.SYS'
Malicious functions:
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtQueryKey, handler: PROCMON20.SYS
- NtOpenKey, handler: PROCMON20.SYS
- NtLoadKey, handler: PROCMON20.SYS
- NtUnloadKey, handler: PROCMON20.SYS
- NtSetValueKey, handler: PROCMON20.SYS
- NtQueryValueKey, handler: PROCMON20.SYS
- NtFlushKey, handler: PROCMON20.SYS
- NtDeleteKey, handler: PROCMON20.SYS
- NtCreateKey, handler: PROCMON20.SYS
- NtClose, handler: PROCMON20.SYS
- NtEnumerateValueKey, handler: PROCMON20.SYS
- NtEnumerateKey, handler: PROCMON20.SYS
- NtDeleteValueKey, handler: PROCMON20.SYS
Modifies file system :
Creates the following files:
- <DRIVERS>\PROCMON20.SYS
Deletes the following files:
- <DRIVERS>\PROCMON20.SYS
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
