Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Service] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Service] 'ImagePath' = '%WINDIR%\FSr.exe'
Creates the following services
- 'Service' %WINDIR%\FSr.exe
Malicious functions
Injects code into
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\2.exe
- %WINDIR%\fsr.exe
Deletes the following files
- %TEMP%\ixp000.tmp\2.exe
Network activity
TCP
Other
- '34.##9.100.209':443
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%TEMP%\ixp000.tmp\2.exe'
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' ВЁГЃ
- '%TEMP%\ixp000.tmp\2.exe' ' (with hidden window)
