Win32.HLLW.Autoruner1.20771

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Dump.exe' = 'C:\Drivers\Dump.exe'

Creates the following files on removable media:

<Drive name for removable media>:\autorun.inf

Malicious functions:

Creates and executes the following:

%TEMP%\1.tmp <Current directory>

Executes the following:

<SYSTEM32>\attrib.exe -s -h C:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +h +s E:\Drivers\Dump.exe
<SYSTEM32>\find.exe /I "naxo" C:\autorun.inf
<SYSTEM32>\attrib.exe +h +s C:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +h +s C:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" E:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" F:\autorun.inf
<SYSTEM32>\attrib.exe +h +s E:\autorun.inf
<SYSTEM32>\attrib.exe +s +h C:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -h -s C:\autorun.inf
<SYSTEM32>\attrib.exe +s +h W:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h X:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h W:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h V:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h V:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Z:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Z:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Y:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h X:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Y:\Drivers\Dump.exe
<SYSTEM32>\find.exe /I "naxo" T:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" U:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" S:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" Q:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" R:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" Y:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" Z:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" X:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" V:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" W:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" J:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" K:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" I:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" G:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" H:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" O:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" P:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" N:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" L:\autorun.inf
<SYSTEM32>\find.exe /I "naxo" M:\autorun.inf
<SYSTEM32>\attrib.exe +s +h U:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h H:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h H:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h G:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h F:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h G:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h J:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h K:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h J:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h I:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h I:\Drivers\Dump.exe
<SYSTEM32>\reg.exe add hklm\software\microsoft\windows\currentversion\run /V Dump.exe /D C:\Drivers\Dump.exe /f
<SYSTEM32>\ping.exe -n 5 127.0.0.1
<SYSTEM32>\msg.exe * hacked by -={ naxo itc }=-
<SYSTEM32>\cmd.exe /c ""%TEMP%\tmpfile0.bat" "
<SYSTEM32>\attrib.exe +s +h "%TEMP%\tmpfile0.bat"
<SYSTEM32>\attrib.exe +s +h E:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h F:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h E:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +h +s C:\Drivers
<SYSTEM32>\attrib.exe +h +s E:\Drivers
<SYSTEM32>\attrib.exe -s -h R:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h R:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Q:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h P:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Q:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h T:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h U:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h T:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h S:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h S:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h M:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h M:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h L:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h K:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h L:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h O:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h P:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h O:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h N:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h N:\Drivers\Dump.exe

Modifies file system :

Creates the following files:

C:\autorun.inf
%TEMP%\tmpfile0.bat
%TEMP%\1.tmp

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\autorun.inf
C:\autorun.inf
%TEMP%\tmpfile0.bat

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information