Win32.HLLW.Autoruner.52822

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftВ® WindowsВ® Operating System' = '%APPDATA%\Microsoft\Protect\Credentials\taskhostt.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe "%APPDATA%\lsass.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MSWUpdate' = '"%APPDATA%\lsass.exe"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'MSWUpdate' = '"%APPDATA%\lsass.exe"'

Creates the following files on removable media

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\lsass.exe" CityScape Enable

Injects code into

the following user processes:

Modifies file system

Creates the following files

Sets the 'hidden' attribute to the following files

Moves the following files

from %APPDATA%\microsoft\protect\credentials\taskhostt.gzp to %APPDATA%\microsoft\protect\credentials\taskhostt.exe
from %APPDATA%\microsoft\protect\credentials\wmpnetvk.gzp to %APPDATA%\microsoft\protect\credentials\wmpnetvk.exe

Network activity

UDP

Miscellaneous

Searches for the following windows

Creates and executes the following

'%APPDATA%\microsoft\protect\credentials\taskhostt.exe'
'%APPDATA%\microsoft\protect\credentials\wmpnetvk.exe'
'%APPDATA%\lsass.exe' /d <Full path to file>
'%APPDATA%\lsass.exe' /d %APPDATA%\Microsoft\Protect\Credentials\wmpnetvk.exe
'%APPDATA%\lsass.exe'
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\lsass.exe" CityScape Enable' (with hidden window)

Executes the following