Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Command Processor] 'AutoRun' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\mmc.exe"'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\mmc.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mmc' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\mmc.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'mmc' = '"%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\mmc.exe"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mmc.lnk
Malicious functions:
Creates and executes the following:
- '%APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\mmc.exe'
- '<Full path to file>'
Executes the following:
- '<SYSTEM32>\taskkill.exe' /t /f /im "<File name>.exe"
- '<SYSTEM32>\cmd.exe' /c taskkill /t /f /im "<File name>.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "<Full path to file>" > NUL
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
- %APPDATA%\generate.jsx
- %APPDATA%\app_updater_smartbutton_focus.png
- %APPDATA%\f15.png
- %APPDATA%\app_updater_header.png
- %APPDATA%\1047x576black.png
- %APPDATA%\ebnf.table.border.xml
- %APPDATA%\glossdef.list.properties.xml
- %APPDATA%\goURL_lr_photoshop_se.csv
- %APPDATA%\boolean_single.js
- %APPDATA%\404-11.htm
- %APPDATA%\back.png
- %APPDATA%\Intermarriage.n
- %APPDATA%\16to9Squareframe_SelectionSubpicture.png
- %APPDATA%\Linker.dll
- %TEMP%\nsg6.tmp
- %APPDATA%\{EAD8C9EB-CE7E-1A35-C2EE-F26F5E13EB94}\mmc.exe
- %APPDATA%\additional_tools_backup_recovery_icon.png
- %APPDATA%\catalogue.xsd
- %APPDATA%\arrow_down.png
- %APPDATA%\body.font.size.xml
- %APPDATA%\filename-prefix.xml
- %APPDATA%\Compressibility.mm
- %APPDATA%\generate.manifest.xml
- %APPDATA%\4to3Squareframe_SelectionSubpicture.png
- %APPDATA%\Costa_Rica
- %APPDATA%\fop1.extensions.xml
- %APPDATA%\Ext-V
- %APPDATA%\401.htm
- %APPDATA%\PachaLeucoblast.j
- %TEMP%\nsb2.tmp
- %APPDATA%\axf.extensions.xml
- %APPDATA%\GMT-7
- %APPDATA%\circle_green.png
- %APPDATA%\Default3DPDF.jsx
- %APPDATA%\Cayenne
- %APPDATA%\16_9-frame-image-mask.png
- %APPDATA%\Barbados
- %APPDATA%\f16.png
- %APPDATA%\app_updater_footer.png
- %APPDATA%\Graph.mi
- %APPDATA%\desc_da_DK.txt
- %APPDATA%\docbook-xsl-update
- %APPDATA%\501.htm
- %APPDATA%\401-5.htm
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
