Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = 'regsvr32.exe "<Full path to file>"'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\cscript.exe
a large number of user processes.
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
