Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\note\notepadnote.exe,'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '34d91dfb34a7283483d0aaba9d10147d' = '%WINDIR%\Microsoft\svchost.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\note\notepadnote.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\centourismeadddynamicoptional001.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\svchost.exe
Creates the following files on removable media
- <Drive name for removable media>:\worm.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Injects code into
the following user processes:
- notepadnote.exe
Modifies file system
Creates the following files
- C:\users\public\vbc.exe
- D:\autorun.inf
- D:\worm.exe
- C:\autorun.inf
- C:\worm.exe
- %HOMEPATH%\documents\my videos\autorun.inf
- %HOMEPATH%\documents\my videos\worm.exe
- %TEMP%\notepadmapdskjlkdf.txt
- %HOMEPATH%\documents\my pictures\autorun.inf
- %HOMEPATH%\documents\my music\autorun.inf
- %HOMEPATH%\documents\my music\worm.exe
- %TEMP%\blackdata.dat
- %WINDIR%\microsoft\svchost.exe
- %APPDATA%\microsoft\windows\templates\controllerfinallineballinglove33.webredirect.exe
- %APPDATA%\microsoft\windows\start menu\new-client 1lluv51.exe
- %HOMEPATH%\documents\my pictures\worm.exe
- %TEMP%\notepadmapdskjlkdf.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\microsoft\svchost.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\svchost.exe
- %TEMP%\blackdata.dat
- %HOMEPATH%\documents\my music\worm.exe
- %HOMEPATH%\documents\my music\autorun.inf
- %HOMEPATH%\documents\my pictures\worm.exe
- %HOMEPATH%\documents\my pictures\autorun.inf
- %HOMEPATH%\documents\my videos\worm.exe
- %HOMEPATH%\documents\my videos\autorun.inf
- C:\worm.exe
- C:\autorun.inf
- D:\worm.exe
- D:\autorun.inf
- <Drive name for removable media>:\worm.exe
- <Drive name for removable media>:\autorun.inf
Network activity
Connects to
- 'an####ciabeach.net':80
- 'ce###########ddynamicoptional001.loseyourip.com':2404
- 'Co############llineballinglove33.webredirect.org':8127
- 'pa###bin.com':443
- 'ce###########ddynamicoptional001.loseyourip.com':6669
TCP
- 'ce###########ddynamicoptional001.loseyourip.com':2404
- 'ce###########ddynamicoptional001.loseyourip.com':8127
- 'pa###bin.com':443
- 'ce###########ddynamicoptional001.loseyourip.com':6669
UDP
- DNS ASK an####ciabeach.net
- DNS ASK ce###########ddynamicoptional001.loseyourip.com
- DNS ASK Co############llineballinglove33.webredirect.org
- DNS ASK pa###bin.com
- DNS ASK mi#######delasantnj.sytes.net
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\note\notepadnote.exe'
- '%APPDATA%\microsoft\windows\start menu\new-client 1lluv51.exe'
- '%APPDATA%\microsoft\windows\templates\controllerfinallineballinglove33.webredirect.exe'
- '%APPDATA%\microsoft\windows\start menu\programs\startup\centourismeadddynamicoptional001.exe'
- '%TEMP%\notepadmapdskjlkdf.exe'
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\note\notepadnote.exe,"
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\note\notepadnote.exe,"
