Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls] 'convpart' = '<SYSTEM32>\cacltvwr.dll'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
the following user processes:
- firefox.exe
- iexplore.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system:
Creates the following files:
- <SYSTEM32>\cacltvwr.dll
- <Current directory>\146421.bat
Deletes the following files:
- <Full path to file>
Miscellaneous:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""<Current directory>\146421.bat" "<Full path to file>""
- '<SYSTEM32>\attrib.exe' -r -s -h"<Full path to file>"
