Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '<File name>.exe' = '<Full path to file>'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Executes the following
- '%WINDIR%\syswow64\net.exe' stop wuauserv
Modifies file system
Creates the following files
- <Current directory>\setting\tpv.ini
- <Current directory>\licn\set.ini
- <Current directory>\setting\lic.ini
- <Current directory>\parametros\tpv.ini
- <Current directory>\setting\tpvbus.ini
- <Current directory>\setting\servidor.ini
- <Current directory>\setting\sql.ini
- <Current directory>\setting\sesion.ini
- <Current directory>\usb_deshabilitar.bat
- <Current directory>\usb_habilitar.bat
- <Current directory>\windowsupdate.bat
- <Current directory>\setting\cmd.ini
- <Current directory>\setting\luxand.ini
Network activity
Connects to
- 'microsoft.com':80
- 'tp###me.com.mx':80
TCP
HTTP POST requests
- http://www.tp###me.com.mx/licencias.php
UDP
- DNS ASK microsoft.com
- DNS ASK tp###me.com.mx
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\USB_Habilitar.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\windowsUpdate.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\USB_Habilitar.bat" "
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
- '%WINDIR%\syswow64\cmd.exe' /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
- '%WINDIR%\syswow64\cmd.exe' /c cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
- '%WINDIR%\syswow64\net1.exe' stop wuauserv
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /flushdns
- '%WINDIR%\syswow64\cmd.exe' /c net stop wuauserv
- '%WINDIR%\syswow64\cmd.exe' /c sc config wuauserv start= disabled
- '%WINDIR%\syswow64\cmd.exe' /c HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update /v AUOptions /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\regedit.exe' /S "<Current directory>\windowsUpdate.reg
- '%WINDIR%\syswow64\regedit.exe' /S "<Current directory>\USB_habilitar.reg
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\windowsUpdate.bat" "
- '%WINDIR%\syswow64\sc.exe' config wuauserv start= disabled
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
