Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'winlogon.exe' = '"%APPDATA%\winlogon.exe"�'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'winlogon.exe' = '"%APPDATA%\winlogon.exe"�'
Creates the following files on removable media
- <Drive name for removable media>:\{user-apmdsmsrnsf}\winlogon.exe
- <Drive name for removable media>:\contoso_1.cer.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\contoso_1.cer
- <Drive name for removable media>:\testee.cer.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\testee.cer
- <Drive name for removable media>:\contoso.cer.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\contoso.cer
- <Drive name for removable media>:\contosoroot.cer.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\contosoroot.cer
- <Drive name for removable media>:\pmd.cer.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\pmd.cer
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\coffee.bmp.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\coffee.bmp
- <Drive name for removable media>:\{user-apmdsmsrnsf}\hanni_umami_chapter.doc
- <Drive name for removable media>:\default.bmp.lnk
- <Drive name for removable media>:\dialmap.bmp.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\dialmap.bmp
- <Drive name for removable media>:\dashborder_192.bmp.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\dashborder_192.bmp
- <Drive name for removable media>:\dashborder_144.bmp.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\dashborder_144.bmp
- <Drive name for removable media>:\toolbar.bmp.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\toolbar.bmp
- <Drive name for removable media>:\delete.avi.lnk
- <Drive name for removable media>:\{user-apmdsmsrnsf}\delete.avi
- <Drive name for removable media>:\join.avi.lnk
- <Drive name for removable media>:\winlogon.exe
- <Drive name for removable media>:\{user-apmdsmsrnsf}\join.avi
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\{user-apmdsmsrnsf}\default.bmp
- <Drive name for removable media>:\hanni_umami_chapter.doc.lnk
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe
- %WINDIR%\explorer.exe
Modifies file system
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\{user-apmdsmsrnsf}\winlogon.exe
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\winlogon.exe
Moves itself
- from <Full path to file> to %APPDATA%\winlogon.exe
Network activity
Connects to
- '80.##.66.215':6725
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe'
