Win32.HLLW.Autoruner2.45410

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm.exe' = '"%ALLUSERSPROFILE%\dwm.exe" ..'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'dwm.exe' = '"%ALLUSERSPROFILE%\dwm.exe" ..'

Creates or modifies the following files:

Creates the following files on removable media:

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

Executes the following:

Terminates or attempts to terminate

the following system processes:

Modifies file system:

Creates the following files:

Sets the 'hidden' attribute to the following files:

Moves the following system files:

Moves the following files:

from <STUBS_DIR>\ecmd\ecmd.exe to %TEMP%\75745
from %HOMEPATH%\Start Menu\Programs\Startup\desktop.ini to %TEMP%\28115
from %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk to %TEMP%\40676
from %HOMEPATH%\Start Menu\Programs\Startup\desktop.ini to %TEMP%\76284
from %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk to %TEMP%\89110

Network activity:

Connects to:

UDP:

Miscellaneous:

Searches for the following windows:

Creates and executes the following:

Executes the following:

'<SYSTEM32>\schtasks.exe' /Delete /tn NYANP /F
'<SYSTEM32>\schtasks.exe' /create /tn NYANP /tr \"C:\\bf32d3b0\\<File name>.exe\" /sc minute /mo 5
'<SYSTEM32>\schtasks.exe' /create /tn NYANP /tr \"C:\\Documents and Settings\\All Users\\dwm.exe\" /sc minute /mo 5