Win32.HLLW.Autoruner2.56435

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\software\Microsoft\Windows\CurrentVersion\Run] '263aa8c95eb91deeea35e0729495c9be' = '"%HOMEPATH%\svchost.exe" ..'
[<HKLM>\software\Microsoft\Windows\CurrentVersion\Run] '263aa8c95eb91deeea35e0729495c9be' = '"%HOMEPATH%\svchost.exe" ..'

Creates or modifies the following files

Creates the following files on removable media

Malicious functions

To bypass firewall, removes or modifies the following registry keys

[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%HOMEPATH%\svchost.exe' = '%HOMEPATH%\svchost.exe:*:Enabled:svchos...

To complicate detection of its presence in the operating system,

forces the system hide from view:

Executes the following

'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%HOMEPATH%\svchost.exe" "svchost.exe" ENABLE

Injects code into

the following user processes:

Modifies file system

Creates the following files

Sets the 'hidden' attribute to the following files

Deletes the following files

Substitutes the following files

Network activity

Connects to

Miscellaneous

Creates and executes the following

'<SYSTEM32>\wscript.exe' "<LS_APPDATA>\bdxtg.vbs"
'<SYSTEM32>\wscript.exe' "<LS_APPDATA>\jvbyjjcw.vbs"
'%HOMEPATH%\svchost.exe'
'<SYSTEM32>\reg.exe' import <LS_APPDATA>\ilrhl.reg' (with hidden window)
'<SYSTEM32>\reg.exe' import <LS_APPDATA>\temo.reg' (with hidden window)
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%HOMEPATH%\svchost.exe" "svchost.exe" ENABLE' (with hidden window)

Executes the following