Trojan.KillFiles2.3265

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Update

Modifies file system

Creates the following files

%WINDIR%\syswow64\wbem\lyfy\del.cmd
%WINDIR%\syswow64\wbem\lyfy\lyfy.vbs
%WINDIR%\syswow64\wbem\lyfy\优化.reg

Deletes the following files

%WINDIR%\dtcinstall.log
%WINDIR%\softwaredistribution\datastore\logs\edb00006.log
%WINDIR%\softwaredistribution\datastore\logs\edb.log
%WINDIR%\softwaredistribution\reportingevents.log
%WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\windowsupdate.log
%WINDIR%\security\logs\scesetup.log
%WINDIR%\performance\winsat\winsat.log
%WINDIR%\panther\unattendgc\setupact.log
%WINDIR%\panther\setuperr.log
%WINDIR%\panther\setupact.log
%WINDIR%\panther\ddaclsys.log
%WINDIR%\panther\cbs_unattend.log
%WINDIR%\panther\cbs.log
%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen_service.log
%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.log
<SYSTEM32>\catroot2\edb00437.log
%WINDIR%\microsoft.net\framework64\v2.0.50727\ngen_service.log
%WINDIR%\microsoft.net\framework\v4.0.30319\ngen_service.log
%WINDIR%\microsoft.net\framework\v4.0.30319\ngen.log
%WINDIR%\microsoft.net\framework\v2.0.50727\ngen_service.log
%WINDIR%\microsoft.net\framework\v2.0.50727\ngen.log
%WINDIR%\inf\setupapi.offline.log
%WINDIR%\inf\setupapi.dev.log
%WINDIR%\inf\setupapi.app.log
%WINDIR%\debug\wia\wiatrace.log
%WINDIR%\debug\sammui.log
%WINDIR%\windowsupdate.log
%WINDIR%\tssysprep.log
%WINDIR%\setuperr.log
%WINDIR%\setupact.log
%WINDIR%\pfro.log
%WINDIR%\microsoft.net\framework64\v2.0.50727\ngen.log
%WINDIR%\winsxs\poqexec.log

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Executes the following

'%WINDIR%\syswow64\wscript.exe' "<SYSTEM32>\wbem\lyfy\lyfy.vbs"
'%WINDIR%\syswow64\findstr.exe' "}\\{"
'%WINDIR%\syswow64\reg.exe' query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}
'%WINDIR%\syswow64\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318} | findstr "}\\{"
'%WINDIR%\syswow64\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v restrictanonymous /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKCU\Console /v LoadConIme /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\regsvr32.exe' /u /s zipfldr.dll
'%WINDIR%\syswow64\reg.exe' add HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer /v Link /t REG_BINARY /d 00000000 /f
'%WINDIR%\syswow64\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v ConfigFileAllocSize /t REG_DWORD /d 500 /f
'%WINDIR%\syswow64\net1.exe' user /delete SUPPORT_388945a0
'%WINDIR%\syswow64\net.exe' user /delete SUPPORT_388945a0
'%WINDIR%\syswow64\net1.exe' user /delete HelpAssistant
'%WINDIR%\syswow64\net.exe' user /delete HelpAssistant
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer /v AlwaysUnloadDLL /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\sc.exe' config ccosm start= disabled
'%WINDIR%\syswow64\sc.exe' config Schedule start= DISABLED
'%WINDIR%\syswow64\sc.exe' config RemoteRegistry start= DISABLED
'%WINDIR%\syswow64\sc.exe' config srservice start= DISABLED
'%WINDIR%\syswow64\sc.exe' config wuauserv start= DISABLED
'%WINDIR%\syswow64\sc.exe' config Messenger start= DISABLED
'%WINDIR%\syswow64\sc.exe' config ImapiService start= DISABLED
'%WINDIR%\syswow64\sc.exe' config helpsvc start= DISABLED
'%WINDIR%\syswow64\sc.exe' config ERSvc start= DISABLED
'%WINDIR%\syswow64\sc.exe' config CiSvc start= DISABLED
'%WINDIR%\syswow64\chkntfs.exe' /t:2
'%WINDIR%\syswow64\regedit.exe' /s <SYSTEM32>\wbem\lyfy\╙┼╗В».reg
'%WINDIR%\syswow64\cmd.exe' /C <SYSTEM32>\wbem\lyfy\DEL.cmd
'%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{06F7F34E-EF30-4870-901D-EA8F1A4CED36}\Connection /v IpCheckingEnabled /t REG_DWORD /d 0 /...
'%WINDIR%\syswow64\sc.exe' config "Ati HotKey Poller" start= DISABLED
'%WINDIR%\syswow64\cmd.exe' /C <SYSTEM32>\wbem\lyfy\DEL.cmd' (with hidden window)