Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\upnphosts] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\upnphosts] 'ImagePath' = '%WINDIR%\ffc0c1f\WerFault.exe /k wcssvc'
Creates the following services
- 'upnphosts' %WINDIR%\ffc0c1f\WerFault.exe /k wcssvc
Modifies file system
Creates the following files
- %CommonProgramFiles%\microsoft shared\vc\csres.exe
Moves itself
- from <Full path to file> to %WINDIR%\ffc0c1f\werfault.exe
Network activity
UDP
- DNS ASK AA###########AAAAAAAAAAAAAAAAFqf.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAF8T.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAGOI.z.teriava.com
- DNS ASK AA############AAAAAAAAAAAAAAAGgM.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAGyw.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAHFE.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAHZU.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAHq5.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAH9N.z.notificeva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAIPC.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAIhG.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAIzq.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAJFe.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAJXT.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAJpn.z.teriava.com
- DNS ASK AA############AAAAAAAAAAAAAAAJ7b.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAKYu.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAKv7.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAALNO.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAALfS.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAALxW.z.notificeva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAMDb.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAMVf.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAMnj.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAM6H.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAANMa.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAANeP.z.teriava.com
- DNS ASK AA############AAAAAAAAAAAAAAANwz.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAOCn.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAOZF.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAOrZ.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAO9N.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAPPC.z.notificeva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAPg2.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAPy7.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAAFP.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAAYC.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAAqG.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAA8K.z.teriava.com
- DNS ASK AA############AAAAAAAAAAAAAAABN_.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAABhR.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAB0E.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAACGJ.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAACX9.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAACpy.z.notificeva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAC72.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAADNb.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAADfQ.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAADxU.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAEDo.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAEVc.z.teriava.com
- DNS ASK AA############AAAAAAAAAAAAAAAEpe.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAFQx.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAFyt.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAGGf.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAGYT.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAGqY.z.notificeva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAG8c.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAHOw.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAHg0.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAHy4.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAIEd.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAIWx.z.teriava.com
- DNS ASK AA############AAAAAAAAAAAAAAAIo1.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAI7Z.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAJN8.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAJfx.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAJx1.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAKD6.z.notificeva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAKV-.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAKnj.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAAK5I.z.vieweva.com
- DNS ASK AA###########AAAAAAAAAAAAAAAALL7.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAALee.z.teriava.com
- DNS ASK AA###########AAAAAAAAAAAAAAAALwj.z.teriava.com
- DNS ASK AA############AAAAAAAAAAAAAAAMC3.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAMWJ.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAMo8.z.tulationeva.com
- DNS ASK AA############AAAAAAAAAAAAAAAM7A.z.notificeva.com
- DNS ASK AA############AAAAAAAAAAAAAAANM1.z.notificeva.com
Miscellaneous
Creates and executes the following
- '%CommonProgramFiles%\microsoft shared\vc\csres.exe'
