Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'db31c9b' = '"<LS_APPDATA>\jidic\jidic.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'db31c9b' = '"<LS_APPDATA>\jidic\jidic.exe"'
Malicious functions:
Creates and executes the following:
- '%TEMP%\WindowsXP-KB968930-x86-ENG.exe' /quiet /norestart
- '%APPDATA%\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\<Virus name>.exe'
- '%TEMP%\WindowsXP-KB968930-x86-ENG.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\regsvr32.exe'
Injects code into
the following system processes:
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000003'
Modifies file system :
Creates the following files:
- %TEMP%\WindowsXP-KB968930-x86-ENG.exe
- <LS_APPDATA>\jidic\jidic.exe
- %APPDATA%\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\<Virus name>.exe
Deletes itself.
Network activity:
Connects to:
- '6.##.53.212':80
- '34.##.31.111':443
- '10.##.202.15':443
- '28.##9.39.188':80
- '49.##7.15.154':80
- '20#.#97.52.75':80
- '24#.#7.98.19':80
- '16#.#9.213.67':80
- '6.##.61.112':80
- '18#.#1.224.73':80
- '10#.82.7.94':8080
- '6.##.90.228':80
- '21#.#18.26.71':80
- '36.#7.52.48':80
- '12#.#09.24.87':8080
- '62.##1.186.248':80
- '23.##.187.134':80
- '19#.#2.81.74':80
- '19#.#46.178.23':80
- '24#.#72.28.236':80
- '16#.#2.9.178':80
- '20#.#13.7.127':443
- '20#.#6.232.182':80
- '10#.#98.218.104':80
- '58.##.241.27':80
- '13#.#3.83.142':80
- '15#.#19.57.112':80
- '21#.#70.243.19':80
- '31.##.186.13':8080
- '11#.#67.56.202':80
- '55.##.27.169':80
- '17#.#45.149.238':443
- '10#.#37.50.164':80
- '10#.#9.69.184':80
TCP:
HTTP GET requests:
- http://do#####d.microsoft.com/download/E/C/E/ECE99583-2003-455D-B681-68DB610B44A4/WindowsXP-KB968930-x86-ENG.exe via 20#.#6.232.182
- http://microsoft.com/ via 20#.#6.232.182
UDP:
- DNS ASK do#####d.microsoft.com
- DNS ASK microsoft.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
