Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSoundDrivers' = '%TEMP%\test.exe'
- %TEMP%\swhost.exe
- %TEMP%\test.exe
- <SYSTEM32>\rundll32.exe InetCpl.cpl,ClearMyTracksByProcess 2
- <SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\sophos-hq-high-5.jpg
- %TEMP%\swhost.exe
- %TEMP%\Sys32\New PC Infected USER-4BB09A9C02.html
- %TEMP%\test.exe
- %TEMP%\sophos-hq-high-5.jpg
- 'sm##.gmail.com':587
- 'wh###smyip.com':80
- wh###smyip.com/automation/n09230945.asp
- DNS ASK sm##.gmail.com
- DNS ASK wh###smyip.com
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''