Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\RasConn] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\RpcSss] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%TEMP%\MS08069.exe'
- '%TEMP%\MS08068.exe'
Executes the following:
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\ry7sbmwV7O.jpg
Modifies file system :
Creates the following files:
- %TEMP%\MS08069.exe
- <SYSTEM32>\RpcSss.dll
- <SYSTEM32>\RasConn.dll
- %TEMP%\ry7sbmwV7O.jpg
- %TEMP%\r200898res46.wmv
- %TEMP%\MS08068.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\RpcSss.dll
Deletes the following files:
- %TEMP%\MS08069.exe
- %TEMP%\MS08068.exe
Network activity:
Connects to:
- 'jp###.kmip.net':80
- 'jp###.kmip.net':809
UDP:
- DNS ASK jp###.kmip.net
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'WMPlayerApp' WindowName: ''
- ClassName: 'Type32_Main_Window' WindowName: ''
- ClassName: '\MSITPro::EventQueue' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
- ClassName: 'WMP9DeskBand' WindowName: 'WMP9DeskBand'
- ClassName: 'ReBarWindow32' WindowName: ''
