Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wmi32' = '"%PROGRAMDATA%\Application Data\wmimgmt.exe"'
Creates the following files on removable media
- <Drive name for removable media>:\recycler\desktop.ini
- <Drive name for removable media>:\~thumbs.tmp
- <Drive name for removable media>:\recycler\wmimgmt.com
Malicious functions
Injects code into
the following user processes:
- wmimgmt.exe
Modifies file system
Creates the following files
- %TEMP%\temp.vih
- %PROGRAMDATA%\application data\wmimgmt.exe
- <LS_APPDATA>\Microsoft\windows\<INETFILES>\drivers.p
- <LS_APPDATA>\Microsoft\windows\<INETFILES>\ghi.bat
- <LS_APPDATA>\Microsoft\windows\<INETFILES>\info.txt
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\recycler\desktop.ini
- <Drive name for removable media>:\autorun.inf
Deletes the following files
- %TEMP%\temp.vih
Substitutes the following files
- %TEMP%\temp.vih
Network activity
UDP
- DNS ASK windowsupdate.microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%PROGRAMDATA%\application data\wmimgmt.exe'
- '%PROGRAMDATA%\application data\wmimgmt.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /v:on /c "<LS_APPDATA>\Microsoft\Windows\<INETFILES>\ghi.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /v:on /c "<LS_APPDATA>\Microsoft\Windows\<INETFILES>\ghi.bat"
- '%WINDIR%\syswow64\findstr.exe' /s "YM.CGP_" "%HOMEPATH%"\..\*.txt
