Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Win32.HLLM.Reset.712

Added to the Dr.Web virus database: 2017-12-16

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\Services\dheydxfw] 'ImagePath' = '<SYSTEM32>\dheydxfw\cujzxjyq.exe'
  • [<HKLM>\SYSTEM\ControlSet001\Services\dheydxfw] 'ImagePath' = '<SYSTEM32>\dheydxfw\cujzxjyq.exe /d"<Full path to file>"'
  • [<HKLM>\SYSTEM\ControlSet001\Services\dheydxfw] 'Start' = '00000002'
Malicious functions:
Injects code into
the following system processes:
  • <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
  • %TEMP%\cujzxjyq.exe
Deletes the following files:
  • <Full path to file>
Moves the following files:
  • from %TEMP%\cujzxjyq.exe to <SYSTEM32>\dheydxfw\cujzxjyq.exe
Network activity:
Connects to:
  • '10#.#3.124.135':443
  • '43.#31.5.6':443
Miscellaneous:
Creates and executes the following:
  • '<SYSTEM32>\dheydxfw\cujzxjyq.exe' /d"<Full path to file>"
Executes the following:
  • '<SYSTEM32>\sc.exe' description dheydxfw "Internet Mobile Support"
  • '<SYSTEM32>\sc.exe' start dheydxfw
  • '<SYSTEM32>\svchost.exe'
  • '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\dheydxfw\
  • '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\cujzxjyq.exe" <SYSTEM32>\dheydxfw\
  • '<SYSTEM32>\sc.exe' create dheydxfw binPath= "<SYSTEM32>\dheydxfw\cujzxjyq.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "P2P Support"