Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'Images' = '%ALLUSERSPROFILE%\images.exe'
Malicious functions
Injects code into
the following user processes:
- klrjgqiwk.exe
Modifies file system
Creates the following files
- %TEMP%\nsw92cd.tmp
- %TEMP%\okzwdhizwk.wto
- %TEMP%\ktoutl.b
- %TEMP%\klrjgqiwk.exe
- %ALLUSERSPROFILE%\images.exe
Miscellaneous
Creates and executes the following
- '%TEMP%\klrjgqiwk.exe' %TEMP%\ktoutl.b
- '%TEMP%\klrjgqiwk.exe'
- '%ALLUSERSPROFILE%\images.exe'
