Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ming' = '<Full path to file>'
Modifies file system:
Creates the following files:
- C:\$RECYCLE.BIN-98411992192-69118pp\Csrss360.exe
- \Device\LanmanRedirector\10.0.0.2\admin$\csrss.exe
Sets the 'hidden' attribute to the following files:
- <Full path to file>
Deletes the following files:
- <SYSTEM32>\config\AppEvent.Evt
- <SYSTEM32>\config\SecEvent.Evt
- C:\$RECYCLE.BIN-98411992192-69118pp\Csrss360.exe
Substitutes the following files:
- C:\$RECYCLE.BIN-98411992192-69118pp\Csrss360.exe
Network activity:
Connects to:
- '<LOCALNET_GATEWAY>':445
- '<LOCALNET_GATEWAY>':139
- '<LOCALNET_GATEWAY>':80
- '<LOCALNET>.0.2':445
- '<LOCALNET>.0.2':80
Miscellaneous:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /d 1 /t REG_DWORD /f
- '<SYSTEM32>\cmd.exe' /c reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations /v ModRiskFileTypes /t REG_SZ /d .exe;.bat;.vbs /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /d 1 /t REG_DWORD /f
- '<SYSTEM32>\reg.exe' add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations /v ModRiskFileTypes /t REG_SZ /d .exe;.bat;.vbs /f
