Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'WDSPDBUSBKeyTool.exe' = '%ProgramFiles(x86)%\SPDB Certificate Tools\Watchdata\WDSPDBUSBKeyTool.exe -RunAsHide'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'WDUIServer_Watchdata CSP v5.1 SPDB.exe' = '<SYSTEM32>\WatchDataV5\Watchdata CSP v5.1 SPDB\WDUIServer_Watchdata CSP v5.1 SPDB.ex...
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\WDTokenServer] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\WDTokenServer] 'ImagePath' = '"%WINDIR%\SysWOW64\WatchDataV5\WDTokenServer\WDTokenServer.exe"'
- [HKLM\System\CurrentControlSet\Services\WDDrvRpr_Watchdata CSP v5.1] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\WDDrvRpr_Watchdata CSP v5.1] 'ImagePath' = '"%WINDIR%\SysWOW64\WatchDataV5\Watchdata CSP v5.1 SPDB\ccid_driver\WDDrvRpr_Watchdata CSP v5.1 SPDB.exe"'
Creates the following services
- 'WDTokenServer' "%WINDIR%\SysWOW64\WatchDataV5\WDTokenServer\WDTokenServer.exe"
- 'WDTokenServer' %WINDIR%\SysWOW64\WatchDataV5\WDTokenServer\WDTokenServer.exe
- 'WDDrvRpr_Watchdata CSP v5.1' "%WINDIR%\SysWOW64\WatchDataV5\Watchdata CSP v5.1 SPDB\ccid_driver\WDDrvRpr_Watchdata CSP v5.1 SPDB.exe"
- 'WDDrvRpr_Watchdata CSP v5.1' %WINDIR%\SysWOW64\WatchDataV5\Watchdata CSP v5.1 SPDB\ccid_driver\WDDrvRpr_Watchdata CSP v5.1 SPDB.exe
Malicious functions
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2500' = '00000003'
Modifies file system
Creates the following files
- %TEMP%\nsp61a0.tmp
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\toolconfig.ini
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\lang_0c04.ini
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\lang_0804.ini
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\lang_0409.ini
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\cfca_sm2_oca1.cer
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\cfca_oca1.cer
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\cfca_cs_sm2_ca_root.cer
- <SYSTEM32>\spdb_wdusbkey.dll
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\wdspdbusbkeytool.exe
- %WINDIR%\syswow64\spdb_wdusbkey.dll
- <SYSTEM32>\wdksp #watchdata csp v5.1 spdb.dll
- %WINDIR%\syswow64\wdksp #watchdata csp v5.1 spdb.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\wddrvrpr_watchdata csp v5.1 spdb.exe
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\usbccid.sys
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\usbccid.inf
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\cfca_cs_ca_root.cer
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\auxlib.dll
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\integrityprotect.ini
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\wdkapi.dll
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\wdkapi.dll
- %WINDIR%\syswow64\watchdatav5\wdtokenserver\uninst.exe
- %WINDIR%\syswow64\watchdatav5\wdtokenserver\drivers\wdk_udk.dll
- %WINDIR%\syswow64\watchdatav5\wdtokenserver\drivers\wdk_hid.dll
- %WINDIR%\syswow64\watchdatav5\wdtokenserver\drivers\wdk_ccid.dll
- %WINDIR%\syswow64\watchdatav5\wdtokenserver\x64_wdkapi.dll
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\usbccid.cat
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\wdkspconfig.exe
- %WINDIR%\syswow64\watchdatav5\wdtokenserver\devguid.conf
- %TEMP%\nsa8dc0.tmp\nsprocessw.dll
- %TEMP%\nsa8dc0.tmp\nsexec.dll
- %TEMP%\nsa8dc0.tmp\userinfo.dll
- %TEMP%\nsa8dc0.tmp\system.dll
- %TEMP%\nsk8daf.tmp
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\wdtokenserversetup.exe
- %WINDIR%\syswow64\watchdatav5\wdtokenserver\wdtokenserver.exe
- %ProgramFiles(x86)%\spdb certificate tools\watchdata\uninst.exe
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\registccid.exe
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\wdsafe3.sig
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\wdsafe3.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\lang_0409.ini
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\wdcsp03.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\wdalglib.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\tokenmgr.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\regtokenmgr_sm2v1.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\progress.gif
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\lang_0c04.ini
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\spd bank certificate manager tool\watchdata\uninstall(watchdata).lnk
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\wduilib.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\hooklib.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\displaykeym26.bmp
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\auxlib.dll
- %TEMP%\nsf6337.tmp\nsexec.dll
- %TEMP%\nsf6337.tmp\nsprocessw.dll
- %TEMP%\nsf6337.tmp\userinfo.dll
- %TEMP%\nsf6337.tmp\system.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\lang_0804.ini
- %WINDIR%\syswow64\watchdatav5\wdtokenserver\x86_wdkapi.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\wdui_colordata.ini
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\wdsafe3.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\watchsafe.ini
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\wdcsp03.dll
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\integrityprotect.ini
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\watchsafe.ini
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\wduilib.dll
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\wdskf.dll
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\wdalglib.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\integrityprotect.ini
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\tokenmgr.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\wdskf.dll
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\wduiserver_watchdata csp v5.1 spdb.exe
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\usbccid.sys
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\usbccid.inf
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\usbccid.cat
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\registccid.exe
- %WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\wdsafe3.sig
- <SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\regtokenmgr_sm2v1.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\spd bank certificate manager tool\watchdata\spd bank certificate manager tool(watchdata).lnk
Deletes the following files
- %TEMP%\nsa8dc0.tmp\nsexec.dll
- %TEMP%\nsa8dc0.tmp\nsprocessw.dll
- %TEMP%\nsa8dc0.tmp\system.dll
- %TEMP%\nsa8dc0.tmp\userinfo.dll
- %TEMP%\nsf6337.tmp\nsexec.dll
- %TEMP%\nsf6337.tmp\nsprocessw.dll
- %TEMP%\nsf6337.tmp\system.dll
- %TEMP%\nsf6337.tmp\userinfo.dll
Miscellaneous
Adds a root certificate
Creates and executes the following
- '%ProgramFiles(x86)%\spdb certificate tools\watchdata\wdtokenserversetup.exe' /DevFilterEx=WDK_UDK,s6spdb01;WDK_UDK,s6spdb02;WDK_UDK,s6spdb03;WDK_UDK,s6spdb04;WDK_CCID,s6spdb01;WDK_CCID,s6spdb02;WDK_CCID,s6spdb03;WDK_CCID,s6spdb04;
- '%WINDIR%\syswow64\watchdatav5\wdtokenserver\wdtokenserver.exe' /Service
- '%WINDIR%\syswow64\watchdatav5\wdtokenserver\wdtokenserver.exe'
- '<SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\registccid.exe'
- '%ProgramFiles(x86)%\spdb certificate tools\watchdata\wdkspconfig.exe' -unregister "Watchdata KSP v5.1 SPDB"
- '%ProgramFiles(x86)%\spdb certificate tools\watchdata\wdkspconfig.exe' -register "Watchdata KSP v5.1 SPDB" "WDKSP #Watchdata CSP v5.1 SPDB.dll" "Watchdata CSP v5.1 SPDB"
- '%WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\wduiserver_watchdata csp v5.1 spdb.exe'
- '%ProgramFiles(x86)%\spdb certificate tools\watchdata\wdspdbusbkeytool.exe' -RunAsHide
- '%WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\wddrvrpr_watchdata csp v5.1 spdb.exe' /Service
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sc stop "WDDrvRpr_Watchdata CSP v5.1 SPDB"
- '%WINDIR%\syswow64\cmd.exe' /c sc start WDTokenServer
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\spdb_WDusbkey.dll"
- '<SYSTEM32>\cmd.exe' /C regsvr32 /s "<SYSTEM32>\spdb_WDusbkey.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\spdb_WDusbkey.dll"
- '%WINDIR%\syswow64\cmd.exe' /C regsvr32 /s "<SYSTEM32>\spdb_WDusbkey.dll"
- '%WINDIR%\syswow64\sc.exe' start WDTokenServer
- '%WINDIR%\syswow64\cmd.exe' /c sc delete WDTokenServer
- '%WINDIR%\syswow64\cmd.exe' /c sc start "WDDrvRpr_Watchdata CSP v5.1 SPDB"
- '%WINDIR%\syswow64\sc.exe' start "WDDrvRpr_Watchdata CSP v5.1 SPDB"
- '%WINDIR%\syswow64\cmd.exe' /c sc delete "WDDrvRpr_Watchdata CSP v5.1 SPDB"
- '%WINDIR%\syswow64\sc.exe' stop WDTokenServer
- '%WINDIR%\syswow64\cmd.exe' /c sc stop WDTokenServer
- '%WINDIR%\syswow64\sc.exe' delete "WDDrvRpr_Watchdata CSP v5.1 SPDB"
- '%WINDIR%\syswow64\sc.exe' stop "WDDrvRpr_Watchdata CSP v5.1 SPDB"
- '%WINDIR%\syswow64\sc.exe' delete WDTokenServer
- '<SYSTEM32>\cmd.exe' /C regsvr32 /s "<SYSTEM32>\spdb_WDusbkey.dll"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop "WDDrvRpr_Watchdata CSP v5.1 SPDB"' (with hidden window)
- '%WINDIR%\syswow64\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\wddrvrpr_watchdata csp v5.1 spdb.exe' /Service' (with hidden window)
- '%ProgramFiles(x86)%\spdb certificate tools\watchdata\wdkspconfig.exe' -unregister "Watchdata KSP v5.1 SPDB"' (with hidden window)
- '<SYSTEM32>\watchdatav5\watchdata csp v5.1 spdb\ccid_driver\registccid.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc start "WDDrvRpr_Watchdata CSP v5.1 SPDB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete "WDDrvRpr_Watchdata CSP v5.1 SPDB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C regsvr32 /s "<SYSTEM32>\spdb_WDusbkey.dll"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop WDTokenServer' (with hidden window)
- '%WINDIR%\syswow64\watchdatav5\wdtokenserver\wdtokenserver.exe' /Service' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete WDTokenServer' (with hidden window)
- '%ProgramFiles(x86)%\spdb certificate tools\watchdata\wdkspconfig.exe' -register "Watchdata KSP v5.1 SPDB" "WDKSP #Watchdata CSP v5.1 SPDB.dll" "Watchdata CSP v5.1 SPDB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc start WDTokenServer' (with hidden window)
