Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinHgfp32] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\7rar\WinHucm32.exe
Executes the following:
- <SYSTEM32>\rundll32.exe newdev.dll,ClientSideInstall \\.\pipe\PNP_Device_Install_Pipe_0.{4607DA8B-2A0E-4323-A163-DEB91DA08222}
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\7rar\WinHucm32.exe
Deletes itself.
Network activity:
Connects to:
- 'any':0
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
