Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\xud042] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\xud042] 'ImagePath' = '%CommonProgramFiles%\Microsoft Shared\MSINFO\jiao0901.exe'
Creates the following services
- 'xud042' %CommonProgramFiles%\Microsoft Shared\MSINFO\jiao0901.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\calc.exe
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %CommonProgramFiles%\microsoft shared\msinfo\jiao0901.exe
- C:\autorun.inf
- C:\jiao0901.exe
- D:\autorun.inf
- D:\jiao0901.exe
- %WINDIR%\syswow64\_jiao0901.exe
Sets the 'hidden' attribute to the following files
- %CommonProgramFiles%\microsoft shared\msinfo\jiao0901.exe
- C:\autorun.inf
- C:\jiao0901.exe
- D:\autorun.inf
- D:\jiao0901.exe
- %WINDIR%\syswow64\_jiao0901.exe
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%CommonProgramFiles%\microsoft shared\msinfo\jiao0901.exe'
Executes the following
- '%WINDIR%\syswow64\calc.exe'
- '%ProgramFiles%\internet explorer\iexplore.exe'
