Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe "%APPDATA%\lsass.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MSWUpdate' = '"%APPDATA%\lsass.exe"'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'MSWUpdate' = '"%APPDATA%\lsass.exe"'
Creates the following files on removable media
- <Drive name for removable media>:\system.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\lsass.exe" CityScape Enable
Injects code into
the following user processes:
- lsass.exe
Modifies file system
Creates the following files
- %APPDATA%\lsass.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\lsass.exe
- <Drive name for removable media>:\system.exe
- <Drive name for removable media>:\autorun.inf
Deletes itself.
Network activity
Connects to
- 'ma##ind.com':80
- 'ma##ind.com':443
TCP
HTTP GET requests
- http://www.ma##ind.com/app/locate_my_ip
Other
- 'ma##ind.com':443
UDP
- DNS ASK ma##ind.com
- DNS ASK ex#####end.no-ip.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'HB'
Creates and executes the following
- '%APPDATA%\lsass.exe' /d <Full path to file>
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\lsass.exe" CityScape Enable' (with hidden window)
