Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\srcsrv] 'ImagePath' = '%WINDIR%\src_srv\winsrcsrv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\srcsrv] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%TEMP%\is-ONRIT.tmp\srvsc.tmp' /SL5="$100E6,362919,56832,%APPDATA%\srvsc.exe" /VERYSILENT
- '%APPDATA%\WB_NI_23_b.exe'
- '%APPDATA%\srvsc.exe' /VERYSILENT
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding 47293120296EFC74B2E1865F81C424A5
- '<SYSTEM32>\sc.exe' create srcsrv start= auto binPath= "%WINDIR%\src_srv\winsrcsrv.exe" DisplayName= "SrcSrv" obj= LocalSystem
- '<SYSTEM32>\msiexec.exe' /i WB_NI_23.msi /qn C=139
- '<SYSTEM32>\msiexec.exe' /V
Modifies file system:
Creates the following files:
- %WINDIR%\src_srv\is-UR2UI.tmp
- %WINDIR%\src_srv\is-KLPUU.tmp
- %WINDIR%\is-CU2E2.tmp
- %WINDIR%\src_srv\is-LHOL1.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\unins000.dat
- %WINDIR%\src_srv\is-VGOUH.tmp
- %WINDIR%\Installer\MSI1.tmp
- %APPDATA%\WB_NI_23_b.exe
- %APPDATA%\srvsc.exe
- %TEMP%\1b49b97d-b785-41e8-a60d-8c4f4a8ec4d5\AgileDotNetRT.dll
- %TEMP%\is-ONRIT.tmp\srvsc.tmp
- %WINDIR%\Installer\281f7.msi
- %TEMP%\is-IBDHH.tmp\_isetup\_shfoldr.dll
- %TEMP%\IXP000.TMP\WB_NI_23.msi
Deletes the following files:
- %WINDIR%\Installer\MSI1.tmp
Moves the following files:
- from %WINDIR%\src_srv\is-LHOL1.tmp to %WINDIR%\src_srv\winsrcsrv.exe
- from %WINDIR%\src_srv\is-VGOUH.tmp to %WINDIR%\src_srv\Trusted.Web.Proxy.dll
- from %WINDIR%\src_srv\is-UR2UI.tmp to %WINDIR%\src_srv\Ionic.Zip.dll
- from %WINDIR%\is-CU2E2.tmp to %WINDIR%\unins000.exe
- from %WINDIR%\src_srv\is-KLPUU.tmp to %WINDIR%\src_srv\accept_cert.exe
Network activity:
Connects to:
- 'of##px.net':443
- 'www.my###search.com':80
- 'wp#d':80
- 'al###.pxpserve.net':80
TCP:
HTTP GET requests:
- http://www.my###search.com/src_srv_api/reportattempt.php?tp############
- http://al###.pxpserve.net/api/api.php?s=####################
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK of##px.net
- DNS ASK www.my###search.com
- DNS ASK wp#d
- DNS ASK al###.pxpserve.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
