Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Log Profile Video Upgrade UPnP Bus] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Log Profile Video Upgrade UPnP Bus] 'ImagePath' = 'C:\ucftvic\ymlzp7lzjw8.exe'
Creates the following services
- 'Log Profile Video Upgrade UPnP Bus' C:\ucftvic\ymlzp7lzjw8.exe
Modifies file system
Creates the following files
- %WINDIR%\ucftvic\xzkhlnjnc5bu
- C:\ucftvic\xzkhlnjnc5bu
- C:\ucftvic\qmwxl3syfrwvrdnnqxwd.exe
- C:\ucftvic\ymlzp7lzjw8.exe
- C:\ucftvic\mfukzvhpnsjwk.exe
- C:\ucftvic\hboymzkr
Sets the 'hidden' attribute to the following files
- C:\ucftvic\ymlzp7lzjw8.exe
- C:\ucftvic\mfukzvhpnsjwk.exe
Deletes the following files
- %WINDIR%\ucftvic\xzkhlnjnc5bu
- C:\ucftvic\qmwxl3syfrwvrdnnqxwd.exe
Substitutes the following files
- %WINDIR%\ucftvic\xzkhlnjnc5bu
Network activity
Connects to
- 'ch#####nenicholson.net':80
TCP
HTTP GET requests
- http://ch#####nenicholson.net/index.php
UDP
- DNS ASK co#####ceblackwood.net
- DNS ASK co#####cedickinson.net
- DNS ASK ha#####tadickinson.net
- DNS ASK ja#####tamartinson.net
- DNS ASK ro#####nemartinson.net
- DNS ASK ja#####tanicholson.net
- DNS ASK ro#####nenicholson.net
- DNS ASK ja#####tawakefield.net
- DNS ASK ro#####newakefield.net
- DNS ASK ja#####tadickinson.net
- DNS ASK ro#####nedickinson.net
- DNS ASK ja#####ynmartinson.net
- DNS ASK cr#####onmartinson.net
- DNS ASK ja#####ynnicholson.net
- DNS ASK cr#####onnicholson.net
- DNS ASK ja#####ynwakefield.net
- DNS ASK cr#####onwakefield.net
- DNS ASK ja#####yndickinson.net
- DNS ASK ha#####tawakefield.net
- DNS ASK co#####cewakefield.net
- DNS ASK ha#####tanicholson.net
- DNS ASK co#####cenicholson.net
- DNS ASK pr#####lamartinson.net
- DNS ASK ma#####anmartinson.net
- DNS ASK pr#####lanicholson.net
- DNS ASK ma#####annicholson.net
- DNS ASK pr#####lawakefield.net
- DNS ASK ma#####anwakefield.net
- DNS ASK pr#####ladickinson.net
- DNS ASK ma#####andickinson.net
- DNS ASK ch#####tamartinson.net
- DNS ASK ka#####ramartinson.net
- DNS ASK ka#####ranicholson.net
- DNS ASK ch#####tanicholson.net
- DNS ASK ka#####rawakefield.net
- DNS ASK ch#####tawakefield.net
- DNS ASK ka#####radickinson.net
- DNS ASK ch#####tadickinson.net
- DNS ASK co#####cemartinson.net
- DNS ASK ha#####tamartinson.net
- DNS ASK de#####stdickinson.net
- DNS ASK cr#####ondickinson.net
- DNS ASK cl#####ndmartinson.net
- DNS ASK ch#####nemartinson.net
- DNS ASK ma#####ansherburne.net
- DNS ASK pr#####lablackwood.net
- DNS ASK ma#####anblackwood.net
- DNS ASK pr#####lapatterson.net
- DNS ASK ma#####anpatterson.net
- DNS ASK pr#####launderhill.net
- DNS ASK ma#####anunderhill.net
- DNS ASK ka#####rasherburne.net
- DNS ASK ch#####tasherburne.net
- DNS ASK ka#####rablackwood.net
- DNS ASK ch#####tablackwood.net
- DNS ASK ka#####rapatterson.net
- DNS ASK ch#####tapatterson.net
- DNS ASK ka#####raunderhill.net
- DNS ASK ch#####taunderhill.net
- DNS ASK co#####cesherburne.net
- DNS ASK ha#####tasherburne.net
- DNS ASK pr#####lasherburne.net
- DNS ASK de#####stunderhill.net
- DNS ASK la#####iaunderhill.net
- DNS ASK de#####stpatterson.net
- DNS ASK ch#####nenicholson.net
- DNS ASK cl#####ndwakefield.net
- DNS ASK ch#####newakefield.net
- DNS ASK cl#####nddickinson.net
- DNS ASK ch#####nedickinson.net
- DNS ASK se#####anmartinson.net
- DNS ASK ch#####namartinson.net
- DNS ASK se#####annicholson.net
- DNS ASK se#####anwakefield.net
- DNS ASK ch#####nanicholson.net
- DNS ASK ch#####nawakefield.net
- DNS ASK se#####andickinson.net
- DNS ASK ch#####nadickinson.net
- DNS ASK la#####iasherburne.net
- DNS ASK de#####stsherburne.net
- DNS ASK la#####iablackwood.net
- DNS ASK de#####stblackwood.net
- DNS ASK la#####iapatterson.net
- DNS ASK cl#####ndnicholson.net
- DNS ASK la#####iadickinson.net
Miscellaneous
Creates and executes the following
- 'C:\ucftvic\qmwxl3syfrwvrdnnqxwd.exe'
- 'C:\ucftvic\ymlzp7lzjw8.exe'
- 'C:\ucftvic\mfukzvhpnsjwk.exe' "c:\ucftvic\ymlzp7lzjw8.exe"
