Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'mstwain32' = '%APPDATA%\mstwain32.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %APPDATA%\ntdtcstp.dll
Modifies file system
Creates the following files
- %APPDATA%\mstwain32.exe
- %APPDATA%\ntdtcstp.dll
- %APPDATA%\cmsetac.dll
- %LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
Network activity
Connects to
- '<LOCALNET>.1.3':15963
Miscellaneous
Creates and executes the following
- '%APPDATA%\mstwain32.exe'
Executes the following
- '%APPDATA%\mstwain32.exe' ' (with hidden window)
