Win32.HLLW.Facebook.1672

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ClipSrv' = '<LS_APPDATA>\Microsoft\clipsrv.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'EseNtUtl' = '%WINDIR%\esentutl.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'WinLogon' = '<LS_APPDATA>\Microsoft\winlogon.exe'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '%WINDIR%\logman.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft RSVP' = '<LS_APPDATA>\Microsoft\Windows\rsvp.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Microsoft RSVP' = '%APPDATA%\Microsoft\rsvp.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Sessmgr' = '%APPDATA%\sessmgr.exe'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '<DRIVERS>\mstsc.exe'

Malicious functions:

Creates and executes the following:

Modifies file system :

Creates the following files:

Deletes the following files:

Moves the following files:

from <LS_APPDATA>\Microsoft\Windows\RCXB.tmp to <LS_APPDATA>\Microsoft\Windows\rsvp.exe
from <LS_APPDATA>\Microsoft\RCXA.tmp to <LS_APPDATA>\Microsoft\clipsrv.exe
from %WINDIR%\RCX9.tmp to %WINDIR%\spoolsv.exe
from <DRIVERS>\RCXC.tmp to <DRIVERS>\mstsc.exe
from <LS_APPDATA>\Microsoft\RCXF.tmp to <LS_APPDATA>\Microsoft\winlogon.exe
from %WINDIR%\RCXE.tmp to %WINDIR%\esentutl.exe
from %WINDIR%\RCXD.tmp to %WINDIR%\logman.exe
from %WINDIR%\RCX8.tmp to %WINDIR%\esentutl.exe
from %APPDATA%\Microsoft\RCX3.tmp to %APPDATA%\Microsoft\rsvp.exe
from %APPDATA%\Microsoft\RCX2.tmp to %APPDATA%\Microsoft\sessmgr.exe
from <LS_APPDATA>\Microsoft\Windows\RCX1.tmp to <LS_APPDATA>\Microsoft\Windows\logman.exe
from <LS_APPDATA>\Microsoft\Windows\RCX4.tmp to <LS_APPDATA>\Microsoft\Windows\rsvp.exe
from %APPDATA%\RCX7.tmp to %APPDATA%\sessmgr.exe
from <LS_APPDATA>\RCX6.tmp to <LS_APPDATA>\sessmgr.exe
from <DRIVERS>\RCX5.tmp to <DRIVERS>\mstsc.exe

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP:

Miscellaneous:

Searches for the following windows: