Win32.HLLW.Autoruner1.36314

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '%ALLUSERSPROFILE%\Application Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\to7jm4.dat,FG00'

Creates or modifies the following files:

Malicious functions:

Creates and executes the following:

'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\to7jm4.dat,FG03
'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\to7jm4.dat,FG04
'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\to7jm4.dat,FG06
'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\to7jm4.dat,FG00
'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\to7jm4.dat,FG01
'%ALLUSERSPROFILE%\Application Data\rundll32.exe' Data\rundll32.exe %ALLUSERSPROFILE%\Application Data\to7jm4.dat,FG02

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2500' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2500' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2500' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2500' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'

Modifies file system :

Creates the following files:

Network activity:

Connects to:

Miscellaneous:

Searches for the following windows: