Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"%1" %*'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Creates and executes the following:
- '<SYSTEM32>\cmd.execf' /c 32788R22FWJFW\prep.cmd >\Bug.txt
- 'C:\32788R22FWJFW\unzip.cfexe' -ojCq "32788R22FWJFW\License\pv_5_2_2.zip" pv.exe -d "C:\32788R22FWJFW"
- '<SYSTEM32>\cmd.execf' /c 32788R22FWJFW\prep.cmd
- 'C:\32788R22FWJFW\n.com' cmdwait 1000 exec hide "~$folder.system$\cmd.execf" /c 32788R22FWJFW\prep.cmd >\Bug.txt
- 'C:\32788R22FWJFW\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
- 'C:\32788R22FWJFW\n.com' cmdwait 2500 exec hide "~$folder.system$\cmd.execf" /c 32788R22FWJFW\prep.cmd
- 'C:\32788R22FWJFW\grep.cfexe' -F "5.2." OsVer
- 'C:\32788R22FWJFW\n.com' win close class "#32770"
- 'C:\32788R22FWJFW\n.com' win close ititle "ComboFix"
- 'C:\32788R22FWJFW\pev.cfexe' -rtf --c:##5#b#f# .\* and not { \md5sum.pif or \OsVer* or \mdCheck00 or \temp0? or *.chm or \Oldsfxname00 or \sfx.cmd or \FileName or \Mui0? or \CatchDeny or \d-del_A.dat or \NlsLanguageDefault or \CHCP.bat }
- 'C:\32788R22FWJFW\grep.cfexe' -F "5.1.2" OsVer
- 'C:\32788R22FWJFW\swreg.exe' query "hklm\system\currentcontrolset\control\productoptions" /v ProductType
- 'C:\32788R22FWJFW\grep.cfexe' -isq "ProductType.*WinNT" WinNT00
- 'C:\32788R22FWJFW\gsar.cfexe' -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "<SYSTEM32>\cmd.execf"
- 'C:\32788R22FWJFW\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
- 'C:\32788R22FWJFW\hidec.exe' 32788R22FWJFW\swreg.exe import 32788R22FWJFW\EXE.reg
- 'C:\32788R22FWJFW\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
- 'C:\32788R22FWJFW\n.com' shexec install 32788R22FWJFW\Prep.inf
- 'C:\32788R22FWJFW\hidec.exe' 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
- 'C:\32788R22FWJFW\hidec.exe' 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
- 'C:\32788R22FWJFW\n.com' exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
- 'C:\32788R22FWJFW\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
- 'C:\32788R22FWJFW\n.com' cmdwait 3000 exec hide 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
- 'C:\32788R22FWJFW\n.com' exec hide 32788R22FWJFW\GSAR.cfexe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "~$folder.system$\cmd.exe" "~$folder.system$\cmd.execf"
- 'C:\32788R22FWJFW\swreg.exe' import 32788R22FWJFW\EXE.reg
- 'C:\32788R22FWJFW\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
- 'C:\32788R22FWJFW\n.com' cmdwait 150 exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
Executes the following:
- '<SYSTEM32>\grpconv.exe' -o
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 C:\32788R22FWJFW\Prep.inf
Modifies file system :
Creates the following files:
- C:\32788R22FWJFW\Policies.dat
- C:\32788R22FWJFW\NetworkService.dat
- C:\32788R22FWJFW\region.dat
- C:\32788R22FWJFW\Purity.dat
- C:\32788R22FWJFW\netsvc.xp.dat
- C:\32788R22FWJFW\netsvc.bad.dat
- C:\32788R22FWJFW\ndis_combofix.dat
- C:\32788R22FWJFW\netsvc.vista.dat
- C:\32788R22FWJFW\netsvc.dat
- C:\32788R22FWJFW\svchost.vista.dat
- C:\32788R22FWJFW\svchost.dat
- C:\32788R22FWJFW\vistareg.dat
- C:\32788R22FWJFW\system_ini.dat
- C:\32788R22FWJFW\svc_wht.dat
- C:\32788R22FWJFW\safeboot.dat
- C:\32788R22FWJFW\rogues.dat
- C:\32788R22FWJFW\safeboot.def.vista.dat
- C:\32788R22FWJFW\safeboot.def.dat
- C:\32788R22FWJFW\tail.cfexe
- C:\32788R22FWJFW\swxcacls.cfexe
- C:\32788R22FWJFW\zip.cfexe
- C:\32788R22FWJFW\unzip.cfexe
- C:\32788R22FWJFW\swsc.cfexe
- C:\32788R22FWJFW\psexec.cfexe
- C:\32788R22FWJFW\NirCmdC.cfexe
- C:\32788R22FWJFW\setpath.cfexe
- C:\32788R22FWJFW\sed.cfexe
- C:\32788R22FWJFW\LocalService.dat
- C:\32788R22FWJFW\Fin.dat
- C:\32788R22FWJFW\LocalSystemNetworkRestricted.dat
- C:\32788R22FWJFW\LocalServiceNetworkRestricted.dat
- C:\32788R22FWJFW\CregC.dat
- C:\32788R22FWJFW\023.dat
- C:\32788R22FWJFW\NirCmd.chm
- C:\32788R22FWJFW\Creg.dat
- C:\32788R22FWJFW\023v.dat
- C:\32788R22FWJFW\image001.gif
- C:\32788R22FWJFW\SvcDrv.vbs
- C:\32788R22FWJFW\License\streamtools.zip
- C:\32788R22FWJFW\License\pv_5_2_2.zip
- C:\32788R22FWJFW\restore_pt.vbs
- C:\32788R22FWJFW\FProps.vbs
- C:\32788R22FWJFW\av.vbs
- C:\32788R22FWJFW\OSid.vbs
- C:\32788R22FWJFW\lnkread.vbs
- C:\32788R22FWJFW\WinNT00
- C:\32788R22FWJFW\OsVer
- C:\32788R22FWJFW\mdCheck00
- C:\32788R22FWJFW\N_\N
- C:\32788R22FWJFW\pev.cfexe
- C:\32788R22FWJFW\pv.exe
- <SYSTEM32>\cmd.execf
- C:\32788R22FWJFW\Nircmd.com
- C:\Bug.txt
- C:\32788R22FWJFW\ERDNTWIN.LOC
- C:\32788R22FWJFW\ERDNTDOS.LOC
- C:\32788R22FWJFW\srizbi.md5
- C:\32788R22FWJFW\ERUNT.LOC
- C:\32788R22FWJFW\ERDNT.e_e
- C:\32788R22FWJFW\xpreg.dat
- C:\32788R22FWJFW\w2kreg.dat
- C:\32788R22FWJFW\zhsvc.dat
- C:\32788R22FWJFW\zDomain.dat
- C:\32788R22FWJFW\run2.sed
- C:\32788R22FWJFW\RegDo.sed
- C:\32788R22FWJFW\DPF.str
- C:\32788R22FWJFW\toolbar.sed
- C:\32788R22FWJFW\REGDACL.sed
- C:\32788R22FWJFW\Exe.reg
- C:\32788R22FWJFW\md5sum.pif
- C:\32788R22FWJFW\embedded.sed
- C:\32788R22FWJFW\ddsDo.sed
- C:\32788R22FWJFW\NirCmd.cfexe
- C:\32788R22FWJFW\SetEnvmt.bat
- C:\32788R22FWJFW\SafeBootRepair.bat
- C:\32788R22FWJFW\Auto-RC.cmd
- C:\32788R22FWJFW\Assoc.cmd
- C:\32788R22FWJFW\RestoreO4.bat
- C:\32788R22FWJFW\List.bat
- C:\32788R22FWJFW\List-D.bat
- C:\32788R22FWJFW\ND_.bat
- C:\32788R22FWJFW\MoveIt.bat
- C:\32788R22FWJFW\CregC.cmd
- C:\32788R22FWJFW\Create.cmd
- C:\32788R22FWJFW\FD-SV.cmd
- C:\32788R22FWJFW\CSet.cmd
- C:\32788R22FWJFW\CF-Script.cmd
- C:\32788R22FWJFW\AWF.cmd
- C:\32788R22FWJFW\av.cmd
- C:\32788R22FWJFW\Catch-sub.cmd
- C:\32788R22FWJFW\Boot-Rk.cmd
- C:\32788R22FWJFW\License\UnxUtilsDist.html
- C:\32788R22FWJFW\License\Zip - license.txt
- C:\32788R22FWJFW\c.bat
- C:\32788R22FWJFW\Boot.bat
- C:\32788R22FWJFW\License\mtee.txt.txt
- C:\32788R22FWJFW\License\dumphive-license.txt
- C:\32788R22FWJFW\License\Curl - license.txt
- C:\32788R22FWJFW\License\FI - license.txt
- C:\32788R22FWJFW\License\EXTRACT.TXT
- C:\32788R22FWJFW\Lang.bat
- C:\32788R22FWJFW\Kollect.bat
- C:\32788R22FWJFW\List-C.bat
- C:\32788R22FWJFW\List-B.bat
- C:\32788R22FWJFW\history.bat
- C:\32788R22FWJFW\DelClsid.bat
- C:\32788R22FWJFW\Combobatch.bat
- C:\32788R22FWJFW\FIXLSP.bat
- C:\32788R22FWJFW\FIND3M.bat
- C:\32788R22FWJFW\appinit.bad
- C:\32788R22FWJFW\RCLink
- C:\32788R22FWJFW\ComboFix-Download.cfexe
- C:\32788R22FWJFW\catchme.cfexe
- C:\32788R22FWJFW\BootSect
- C:\32788R22FWJFW\swreg.exe
- C:\32788R22FWJFW\pev.exe
- C:\32788R22FWJFW\Combo-Fix.sys
- C:\32788R22FWJFW\ffdefstr.dll
- C:\32788R22FWJFW\handle.cfexe
- C:\32788R22FWJFW\gsar.cfexe
- C:\32788R22FWJFW\mtee.cfexe
- C:\32788R22FWJFW\moveex.cfexe
- C:\32788R22FWJFW\grep.cfexe
- C:\32788R22FWJFW\dumphive.cfexe
- C:\32788R22FWJFW\dd.cfexe
- C:\32788R22FWJFW\extract.cfexe
- C:\32788R22FWJFW\ERUNT.cfexe
- C:\32788R22FWJFW\Prep.cmd
- C:\32788R22FWJFW\NT-OS.cmd
- C:\32788R22FWJFW\Rkey.cmd
- C:\32788R22FWJFW\RegScan.cmd
- C:\32788R22FWJFW\Kill-All.cmd
- C:\32788R22FWJFW\GetHive.cmd
- C:\32788R22FWJFW\FKMGen.cmd
- C:\32788R22FWJFW\katch.cmd
- C:\32788R22FWJFW\Install-RC.cmd
- C:\32788R22FWJFW\Prep.inf
- C:\32788R22FWJFW\clsid.c
- C:\32788R22FWJFW\hidec.exe
- C:\32788R22FWJFW\n.com
- C:\32788R22FWJFW\badclsid.c
- C:\32788R22FWJFW\SRestore.cmd
- C:\32788R22FWJFW\SnapShot.cmd
- C:\32788R22FWJFW\Update-CF.cmd
- C:\32788R22FWJFW\SuppScan.cmd
Deletes the following files:
- C:\32788R22FWJFW\WinNT00
- C:\32788R22FWJFW\pv.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
