Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'mstwain32' = '%WINDIR%\mstwain32.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %WINDIR%\ntdtcstp.dll
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\video.exe
- %TEMP%\intro sony vegas.flv
- %WINDIR%\mstwain32.exe
- %WINDIR%\ntdtcstp.dll
- %WINDIR%\cmsetac.dll
Network activity
UDP
- DNS ASK tu######lantie.no-ip.org
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\video.exe'
- '%WINDIR%\mstwain32.exe'
Executes the following
- '%WINDIR%\mstwain32.exe' ' (with hidden window)
