Win32.HLLW.Autoruner2.15720

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Twain' = '%WINDIR%\twain.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System Service' = '%WINDIR%\System.exe'

Creates the following files on removable media:

<Drive name for removable media>:\RESTORE\S-1-5-21-1659004503-1580436667-1417001333-1003\usbflash.exe
<Drive name for removable media>:\RESTORE\S-1-5-21-1659004503-1580436667-1417001333-1003\desktop.ini
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\Scandals.exe

Malicious functions:

Creates and executes the following:

Executes the following:

Modifies file system :

Creates the following files:

%TEMP%\aut1D.tmp
%TEMP%\aut1C.tmp
%TEMP%\aut1B.tmp
%TEMP%\aut1E.tmp
%TEMP%\aut21.tmp
%TEMP%\aut20.tmp
%TEMP%\aut1F.tmp
%TEMP%\aut16.tmp
%TEMP%\aut15.tmp
%TEMP%\aut14.tmp
%TEMP%\aut17.tmp
%TEMP%\aut1A.tmp
%TEMP%\aut19.tmp
%TEMP%\aut18.tmp
%TEMP%\aut22.tmp
%TEMP%\aut2C.tmp
%TEMP%\aut2B.tmp
%TEMP%\aut2A.tmp
%TEMP%\aut2D.tmp
%TEMP%\aut30.tmp
%TEMP%\aut2F.tmp
%TEMP%\aut2E.tmp
%TEMP%\aut25.tmp
%TEMP%\aut24.tmp
%TEMP%\aut23.tmp
%TEMP%\aut26.tmp
%TEMP%\aut29.tmp
%TEMP%\aut28.tmp
%TEMP%\aut27.tmp
%TEMP%\aut5.tmp
%WINDIR%\ecruoser.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\IP-h4[1].htm
%TEMP%\aut6.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\adds-h2[1].htm
%WINDIR%\sliame.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mails-h3[1].htm
%WINDIR%\msngr.exe
%TEMP%\aut1.tmp
%WINDIR%\System.exe
%TEMP%\aut2.tmp
%TEMP%\aut4.tmp
%TEMP%\aut3.tmp
%WINDIR%\winlogon64.exe
%WINDIR%\stnemmoc.ocx
%TEMP%\autF.tmp
%TEMP%\autE.tmp
%TEMP%\autD.tmp
%TEMP%\aut10.tmp
%TEMP%\aut13.tmp
%TEMP%\aut12.tmp
%TEMP%\aut11.tmp
%TEMP%\aut9.tmp
%TEMP%\aut8.tmp
%TEMP%\aut7.tmp
%TEMP%\autA.tmp
%TEMP%\autC.tmp
%TEMP%\autB.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\friendster[1]

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\RESTORE\S-1-5-21-1659004503-1580436667-1417001333-1003\desktop.ini
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\RESTORE\S-1-5-21-1659004503-1580436667-1417001333-1003\usbflash.exe

Deletes the following files:

%TEMP%\aut20.tmp
%TEMP%\aut1F.tmp
%TEMP%\aut1E.tmp
%TEMP%\aut23.tmp
%TEMP%\aut22.tmp
%TEMP%\aut21.tmp
%TEMP%\aut1A.tmp
%TEMP%\aut19.tmp
%TEMP%\aut18.tmp
%TEMP%\aut1D.tmp
%TEMP%\aut1C.tmp
%TEMP%\aut1B.tmp
%TEMP%\aut24.tmp
%TEMP%\aut2D.tmp
%TEMP%\aut2C.tmp
%TEMP%\aut2B.tmp
%TEMP%\aut30.tmp
%TEMP%\aut2F.tmp
%TEMP%\aut2E.tmp
%TEMP%\aut27.tmp
%TEMP%\aut26.tmp
%TEMP%\aut25.tmp
%TEMP%\aut2A.tmp
%TEMP%\aut29.tmp
%TEMP%\aut28.tmp
%TEMP%\aut7.tmp
<Drive name for removable media>:\RESTORE\S-1-5-21-1659004503-1580436667-1417001333-1003\usbflash.exe
<Drive name for removable media>:\Scandals.exe
%TEMP%\autA.tmp
%TEMP%\aut9.tmp
%TEMP%\aut8.tmp
%TEMP%\aut3.tmp
%TEMP%\aut2.tmp
%TEMP%\aut1.tmp
%TEMP%\aut6.tmp
%TEMP%\aut5.tmp
%TEMP%\aut4.tmp
%TEMP%\autB.tmp
%TEMP%\aut14.tmp
%TEMP%\aut13.tmp
%TEMP%\aut12.tmp
%TEMP%\aut17.tmp
%TEMP%\aut16.tmp
%TEMP%\aut15.tmp
%TEMP%\autE.tmp
%TEMP%\autD.tmp
%TEMP%\autC.tmp
%TEMP%\aut11.tmp
%TEMP%\aut10.tmp
%TEMP%\autF.tmp

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP:

Miscellaneous:

Searches for the following windows: