Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\services\javatmsup] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\schdpdb.exe' 3cs
- '<SYSTEM32>\tapiapi.exe' local system
Executes the following:
- '<SYSTEM32>\taskeng.exe' {6E5A99F5-0697-4169-AAC9-0799103D84A7} S-1-5-18:NT AUTHORITY\System:Service:
Modifies file system :
Creates the following files:
- <SYSTEM32>\Tasks\Microsoft\Windows\Media Center\PBDARegisterSW
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dbconfig[1].php
- <LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\dbconfig[1].php
- <SYSTEM32>\schdpdb.exe
- <SYSTEM32>\nturl.exe
- %TEMP%\323b9b99-1f18-4116-ab1f-197e2abe015a
- <SYSTEM32>\tapiapi.exe
Moves the following files:
- from %TEMP%\323b9b99-1f18-4116-ab1f-197e2abe015a to %TEMP%\wdmcpl.exe
Network activity:
Connects to:
- '18#.#16.32.164':80
- 'localhost':52754
- '18#.#16.32.164':21
TCP:
HTTP GET requests:
- 18#.#16.32.164/cms_include/dbconfig.php?m&###################################################################################################################
UDP:
- DNS ASK dn#.##ftncsi.com
