Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\DllHost.exe' /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
- '<SYSTEM32>\sysprep\sysprep.exe'
- '<SYSTEM32>\DllHost.exe' /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
- '<SYSTEM32>\rundll32.exe' "%APPDATA%\Roaming\tmp7C80.tmp", Install <Full path to virus>
- '<SYSTEM32>\consent.exe' 856 256 00000000030D4480
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- <SYSTEM32>\sysprep\CRYPTBASE.DLL
- %APPDATA%\Roaming\tmp7C80.tmp
- %APPDATA%\Roaming\tmp7C6F.tmp
Deletes itself.
