Win32.HLLW.Autoruner2.63470

Added to the Dr.Web virus database: 2019-10-01

Virus description added: 2019-10-03

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Update' = '%APPDATA%\WindowsUpdate.exe'

Creates or modifies the following files

Creates the following files on removable media

Malicious functions

To complicate detection of its presence in the operating system,

forces the system hide from view:

Injects code into

the following system processes:

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Software\Microsoft\MSNMessenger]
[<HKCU>\Software\Yahoo\Pager]
[<HKCU>\Software\Microsoft\IdentityCRL]
[<HKCU>\Software\Microsoft\Windows Live Mail]

Modifies file system

Creates the following files

C:\smrxxwnxj\ntprint\wmpdmc.scr
%APPDATA%\pid.txt
%APPDATA%\pidloc.txt
%APPDATA%\windowsupdate.exe
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
<LS_APPDATA>\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol

Sets the 'hidden' attribute to the following files

Network activity

UDP

Miscellaneous

Executes the following

'%WINDIR%\microsoft.net\framework\v2.0.50727\regasm.exe'
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /stext "%TEMP%\holdermail.txt"
'%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /stext "%TEMP%\holderwb.txt"