Win32.HLLW.Autoruner1.61780

To ensure autorun and distribution:

Creates or modifies the following files:

Creates the following files on removable media:

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\winlogon.exe' = '<SYSTEM32>\winlogon.exe:*:enabled:@shell32.dll,-1'
<Auxiliary element>
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\doc vol meyo yde.exe' = '%TEMP%\doc vol meyo yde.exe:*:Enabled:ipsec'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'

To complicate detection of its presence in the operating system,

forces the system hide from view:

blocks execution of the following system utilities:

blocks the following features:

Creates and executes the following:

Executes the following:

'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fon6vdq9.cmdline"

Injects code into

the following system processes:

a large number of user processes.

Restores hooked functions in System Service Descriptor Table (SSDT).

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Network activity:

Connects to:

UDP: