Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows32KernelStart' = '"%APPDATA%\wks.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows32KernelStart' = '"%APPDATA%\wks.exe"'
- [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices] 'Windows32KernelStart' = '"%APPDATA%\wks.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices] 'Windows32KernelStart' = '"%APPDATA%\wks.exe"'
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\wscsvc] 'Start' = '00000001'
- [HKCU\SYSTEM\CurrentControlSet\Services\wscsvc] 'Start' = '00000001'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
modifies the following system settings:
- Hides taskbar notifications
Modifies file system
Creates the following files
- %APPDATA%\wks.exe
- %LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
Network activity
Connects to
- 'google.com':80
- '61.##7.75.89':80
- '11#.#4.189.89':80
TCP
HTTP GET requests
- http://google.com/
- http://www.google.com/
UDP
- DNS ASK google.com
- DNS ASK tr###ecig.com
