Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\W32Time] 'Start' = '00000002'
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop w32time
Patches code
in NTDLL dll
- vgpegx.exe process, ntdll.dll module
- setup18134.com process, ntdll.dll module
Intercepts control using hardware breakpoints
in dll
- vgpegx.exe process, unknown module
- setup18134.com process, unknown module
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: 'OllYDbg'
Modifies file system
Creates the following files
- conout$
- <Current directory>\setup18134.com
- C:\csb.ini
- nul
Deletes following files that it created itself
- <Current directory>\setup18134.com
Network activity
Connects to
- 'localhost':49693
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'e7.#.lencr.org':80
TCP
HTTP GET requests
- http://e7.#.lencr.org/102.crl
Other
- 'localhost':49693
- 'localhost':49694
- 'ke##uth.win':443
UDP
- DNS ASK 0.##.#ool.ntp.org
- DNS ASK 1.##.#ool.ntp.org
- DNS ASK 3.##.#ool.ntp.org
- DNS ASK 2.##.#ool.ntp.org
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK e7.#.lencr.org
Miscellaneous
Creates and executes the following
- '<Current directory>\setup18134.com'
Executes the following
- '<SYSTEM32>\cmd.exe' /c del *.com /s /f /q >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c del %WINDIR%\Prefetch\* /s /f /q >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c del %TEMP%\* /s /f /q >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c del %appdata%\Microsoft\Windows\Recent\* /s /f /q >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c fsutil usn deletejournal /d C: >nul 2>&1
- '<SYSTEM32>\fsutil.exe' usn deletejournal /d C
- '<SYSTEM32>\cmd.exe' /c w32tm /query /peers >nul 2>&1
- '<SYSTEM32>\w32tm.exe' /query /peers
- '<SYSTEM32>\cmd.exe' /c sc config w32time start=auto >nul 2>&1
- '<SYSTEM32>\sc.exe' config w32time start=auto
- '<SYSTEM32>\cmd.exe' /c w32tm /config /syncfromflags:manual /manualpeerlist:"0.us.pool.ntp.org, 1.us.pool.ntp.org, 2.us.pool.ntp.org, 3.us.pool.ntp.org" >nul 2>&1
- '<SYSTEM32>\w32tm.exe' /config /syncfromflags:manual /manualpeerlist:"0.us.pool.ntp.org, 1.us.pool.ntp.org, 2.us.pool.ntp.org, 3.us.pool.ntp.org"
- '<SYSTEM32>\cmd.exe' /c w32tm /config /reliable:yes >nul 2>&1
- '<SYSTEM32>\w32tm.exe' /config /reliable:yes
- '<SYSTEM32>\cmd.exe' /c net stop w32time >nul 2>&1
- '<SYSTEM32>\net1.exe' stop w32time
- '<SYSTEM32>\cmd.exe' /c net start w32time >nul 2>&1
- '<SYSTEM32>\net.exe' start w32time
- '<SYSTEM32>\net1.exe' start w32time
- '<SYSTEM32>\cmd.exe' /c w32tm /resync /nowait >nul 2>&1
- '<SYSTEM32>\w32tm.exe' /resync /nowait
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Current directory>\setup18134.com" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "<Current directory>\setup18134.com" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Current directory>\setup18134.com" MD5 | find /i /v "md5" | find /i /v "certutil"' (with hidden window)
