Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\software\Wow6432Node\microsoft\windows\currentversion\Policies\Explorer\Run] '28007' = '%ProgramFiles%\locals~1\temp\msavfqpi.scr'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %ProgramFiles%\locals~1\temp\msavfqpi.scr
Deletes itself.
Network activity
TCP
Other
- '34.##9.100.209':443
UDP
- DNS ASK ap#####atecheckerd.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
