Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Encrypting File System (EFS)' = '%LOCALAPPDATA%\GFIR\wininit-svc.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%LOCALAPPDATA%\GFIR\wininit-svc.exe" "Microsoft Encrypting File System (EFS)" ENABLE
Brute-forces OS accounts.
Modifies file system
Creates the following files
- %LOCALAPPDATA%\gfir\wininit-svc.exe
- %LOCALAPPDATA%\gfir\systemsvc.exe
Deletes itself.
Network activity
Connects to
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK ma####qwesta.com
- DNS ASK ex####onstars.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\gfir\wininit-svc.exe'
- '%LOCALAPPDATA%\gfir\systemsvc.exe'
- '%LOCALAPPDATA%\gfir\wininit-svc.exe' ' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%LOCALAPPDATA%\GFIR\wininit-svc.exe" "Microsoft Encrypting File System (EFS)" ENABLE' (with hidden window)
