Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\zinjgvq] 'ImagePath' = '%TEMP%\<File name>.sys'
- [HKLM\System\CurrentControlSet\Services\abce1] 'ImagePath' = '<DRIVERS>\abce1.sys:''
Creates the following services
- 'zinjgvq' %TEMP%\<File name>.sys
Malicious functions
Patches code
in NTDLL dll
- zinjgvq.exe process, ntdll.dll module
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\<File name>.sys
- <DRIVERS>\abce1.sys
- <DRIVERS>\abce1.sys:'
- nul
Deletes following files that it created itself
- <DRIVERS>\abce1.sys
Moves itself
- from <Full path to file> to \:r0m4
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 2 > nul & del /f /q "<Full path to file>"
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 2
