Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Application' = '%APPDATA%\taskhost.exe'
Malicious functions
Injects code into
the following user processes:
- taskhost.exe
Modifies file system
Creates the following files
- %APPDATA%\taskhost.exe
- %TEMP%\mscorsvw1.exe
- %APPDATA%\taskhost_signed.exe
- %HOMEPATH%\documents\delay.txt
- %ProgramFiles(x86)%\client\taskhiost.exe
Deletes the following files
- %TEMP%\mscorsvw1.exe
- %APPDATA%\taskhost.exe
Substitutes the following files
- %APPDATA%\taskhost.exe
Network activity
Connects to
- 'public-trust.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
- DNS ASK public-trust.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\taskhost.exe'
