Win32.HLLW.Autoruner.62474

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'StartKey' = '<SYSTEM32>\setpaths.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'StartKey' = '<SYSTEM32>\setpaths.exe'
[<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{15CDF7EC-751B-46aa-AD69-4005FE080DE8}] 'stubpath' = ''
[<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{15CDF7EC-751B-46aa-AD69-4005FE080DE9}] 'stubpath' = ''
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ccSetMgr' = '%ALLUSERSPROFILE%\Application Data\ccSetMgr.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Hkcmds' = '<SYSTEM32>\hkcmds.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Hkcmds' = '<SYSTEM32>\hkcmds.exe'

Creates the following files on removable media:

<Drive name for removable media>:\AutoRun.inf
<Drive name for removable media>:\Recycler\S-1-5-21-5705561107-358453775-6007341644-500\desktop.ini
<Drive name for removable media>:\Recycler\S-1-5-21-5705561107-358453775-6007341644-500\~WRL4904.tmp

Malicious functions:

Creates and executes the following:

Injects code into

the following system processes:

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\Recycler\S-1-5-21-5705561107-358453775-6007341644-500\desktop.ini
<Drive name for removable media>:\AutoRun.inf
%ALLUSERSPROFILE%\Application Data\services.exe
<Drive name for removable media>:\Recycler\S-1-5-21-5705561107-358453775-6007341644-500\~WRL4904.tmp

Deletes the following files:

Deletes itself.

Network activity:

Connects to:

UDP:

Miscellaneous:

Searches for the following windows: