Win32.HLLW.Autoruner2.18981

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '363' = 'C:\svchosto.exe'
[<HKLM>\SOFTWARE\Classes\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc003}\shell\Open\Command] '' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.hao123.com/?tn=97405087_hao_pg '
[<HKLM>\SOFTWARE\Classes\CLSID\{e17d4f88-5564-41d1-83f2-00a0c90dc002}\shell\Open\Command] '' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://shop1399222689674.1688.com/ '
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '362' = 'h:\svchosto.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '36555' = '<SYSTEM32>\svchosto.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '360' = 'f:\svchosto.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '361' = 'g:\svchosto.exe'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\IMWMRTYD] 'ImagePath' = '<DRIVERS>\IMWMRTYD.sys'

Creates the following files on removable media:

Malicious functions:

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Creates and executes the following:

Executes the following:

Hooks the following functions in System Service Descriptor Table (SSDT):

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Moves the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

ji#####wnload.2345.cn/jifen_2345/p3_k61539783_jg5WdGMIHVpWud2V9HTY2_v14.12.1.exe
www.ha##23.com/?tn################

UDP:

Miscellaneous:

Searches for the following windows: