Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Winsys' = '<SYSTEM32>\w'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Win32' = '<SYSTEM32>\w'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
modifies the following system settings:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Internet Explorer\Main] 'Window Title' = 'Vive Les Marmottes qu'
Modifies file system
Creates the following files
- %WINDIR%\syswow64\winsock.exe
- %WINDIR%\syswow64\winkernel32.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\winsock.exe
- %WINDIR%\syswow64\winkernel32.exe
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h +s "<SYSTEM32>\winsock.exe"
- '%WINDIR%\syswow64\attrib.exe' +h +s "<SYSTEM32>\winsock.exe"
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h +s "<SYSTEM32>\winkernel32.exe"
- '%WINDIR%\syswow64\attrib.exe' +h +s "<SYSTEM32>\winkernel32.exe"
