Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'sv.exe' = '%TEMP%\sv.exe\sv.exe.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe] 'Debugger' = 'nsjw.exe'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows COM Host' = 'C:\{$8975-4932-7241-6744$}\sv.exe -rundll32 /SYSTEM32 "<SYSTEM32>\taskmgr.exe" "%ProgramFiles%\Microsoft...
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = 'C:\{$8975-4932-7241-6744$}\sv.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '<Full path to file>'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows COM Host' = '<Full path to file> -rundll32 /SYSTEM32 "<SYSTEM32>\taskmgr.exe" "%ProgramFiles%\Microsoft\Windows"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\sv.exe.url
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks the following features:
- System Restore (SR)
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\sv.exe\sv.exe.exe
- C:\{$8975-4932-7241-6744$}\sv.exe
- %PROGRAMDATA%\898191165.exe
- %PROGRAMDATA%\898191165.vbs
Sets the 'hidden' attribute to the following files
- C:\{$8975-4932-7241-6744$}\sv.exe
- <Full path to file>
- %PROGRAMDATA%\898191165.exe
Deletes the following files
- %WINDIR%\syswow64\useraccountcontrolsettings.exe
- %PROGRAMDATA%\898191165.vbs
Substitutes the following files
- %PROGRAMDATA%\898191165.vbs
Network activity
UDP
- DNS ASK 4l####5tc.zapto.org
Miscellaneous
Creates and executes the following
- 'C:\{$8975-4932-7241-6744$}\sv.exe'
- '%WINDIR%\syswow64\wscript.exe' "%PROGRAMDATA%\898191165.vbs"
- '%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\UserAccountControlSettings.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "%PROGRAMDATA%\898191165.vbs"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\takeown.exe' /F <SYSTEM32>\UserAccountControlSettings.exe
- '%WINDIR%\syswow64\cmd.exe' /c "%PROGRAMDATA%\898191165.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%PROGRAMDATA%\898191165.vbs"
