Win32.HLLW.Autoruner1.39253

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '%ALLUSERSPROFILE%\Application Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\li2je.dat,FG00'

Creates or modifies the following files:

Malicious functions:

Creates and executes the following:

'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\li2je.dat,FG03
'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\li2je.dat,FG04
'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\li2je.dat,FG06
'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\li2je.dat,FG00
'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\li2je.dat,FG01
'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\li2je.dat,FG02

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2500' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2500' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2500' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2500' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'

Modifies file system :

Creates the following files:

%ALLUSERSPROFILE%\Application Data\ej2il.js
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%ALLUSERSPROFILE%\Application Data\ej2il.pad
%ALLUSERSPROFILE%\Application Data\rundll32.exe
%ALLUSERSPROFILE%\Application Data\li2je.dat

Network activity:

Connects to:

Miscellaneous:

Searches for the following windows: