Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\wmcserv] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\wmcserv.exe' -d "%TEMP%\norton.exe"
- '<SYSTEM32>\wmcserv.exe' -v
- '%TEMP%\12TO13.EXE'
- '%TEMP%\norton.exe'
Injects code into
the following system processes:
- <SYSTEM32>\lsass.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\wmcserv.exe
- %TEMP%\norton.exe
- %TEMP%\12TO13.EXE
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\wmcserv.exe
Deletes the following files:
- %TEMP%\norton.exe
Network activity:
Connects to:
- 'ww#####rosoft.9966.org':80
UDP:
- DNS ASK ww#####rosoft.9966.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
