Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'BackUp2296801295' = '%APPDATA%\BackUp2296801295.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\BS2296801295] 'ImagePath' = '%TEMP%\NTFS.sys'
Malicious functions:
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Modifies file system:
Creates the following files:
- %TEMP%\NTFS.sys
- %APPDATA%\BackUp2296801295.exe
- %TEMP%\tmp4.tmp
- %TEMP%\tmp3.tmp
- %TEMP%\tmp1.tmp
- %TEMP%\L2296801295
- %TEMP%\tmp2.tmp
Network activity:
Connects to:
- 'localhost':1042
- 'localhost':1039
- 'sr####press3.com':80
TCP:
HTTP POST requests:
- http://sr####press3.com/cgi-bin/020815/post.cgi
UDP:
- DNS ASK sr####press3.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
