Technical Information
Malicious functions
Injects code into
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\serwin.exe
- %TEMP%\ixp000.tmp\getcam~1.exe
- %TEMP%\decrypted.exe
- %APPDATA%\kernel33.dll
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\serwin.exe'
- '%TEMP%\decrypted.exe'
- '%TEMP%\ixp000.tmp\getcam~1.exe'
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' "%TEMP%\Decrypted.exe"
