Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lqwsmfswjrk' = 'regsvr32 /s "%APPDATA%\lqwsmfswjrk.jpg"'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' -f -im iexplore.exe
Injects code into
the following user processes:
- iexplore.exe
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'l3dll'
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'nidll'
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v lqwsmfswjrk /d "regsvr32 /s """%APPDATA%\lqwsmfswjrk.jpg"""" /f
- '%WINDIR%\syswow64\taskkill.exe' -f -im iexplore.exe' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v lqwsmfswjrk /d "regsvr32 /s """%APPDATA%\lqwsmfswjrk.jpg"""" /f' (with hidden window)
