Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\svchost.exe'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\svchost.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,%TEMP%\svchost.exe'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\WinSecurity] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\WinSecurity] 'ImagePath' = '%TEMP%\svchost.exe'
Creates the following services
- 'WinSecurity' %TEMP%\svchost.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
Modifies file system
Creates the following files
- %TEMP%\svchost.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\svchost.exe
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost.exe'
Executes the following
- '<SYSTEM32>\sc.exe' create WinSecurity binPath= "%TEMP%\svchost.exe" start= auto
- '<SYSTEM32>\sc.exe' start WinSecurity
- '<SYSTEM32>\sc.exe' create WinSecurity binPath= "%TEMP%\svchost.exe" start= auto' (with hidden window)
- '<SYSTEM32>\sc.exe' start WinSecurity' (with hidden window)
