Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svcchost' = '<SYSTEM32>\svcchost.exe S'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Modifies file system:
Creates the following files:
- %TEMP%\a24386.bat
- <SYSTEM32>\svcchost.exe
Sets the 'hidden' attribute to the following files:
- %TEMP%\a24386.bat
- <SYSTEM32>\svcchost.exe
Miscellaneous:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c %TEMP%\a24386.bat <Full path to file>
- '<SYSTEM32>\cmd.exe' /S /D /c" echo f"
- '<SYSTEM32>\xcopy.exe' <Full path to file> <SYSTEM32>\svcchost.exe /h /y
- '<SYSTEM32>\attrib.exe' +s +h +r +a <SYSTEM32>\svcchost.exe
- '<SYSTEM32>\reg.exe' add HKLM\software\Microsoft\Windows\CurrentVersion\run /v svcchost /t REG_SZ /d "<SYSTEM32>\svcchost.exe S" /f
- '<SYSTEM32>\reg.exe' add HKCR\Unknown\shell\openas\command /v "" /t REG_SZ /d "<SYSTEM32>\svcchost.exe S" /f
- '<SYSTEM32>\reg.exe' add HKCU\software\Microsoft\Windows\CurrentVersion\Policies\System /v "DisableTaskMgr" /t REG_DWORD /d 0000001 /f
