Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] 'DLMon' = '{590498A3-4131-4D8F-BA4B-36791A0803B1}'
Modifies file system
Creates the following files
- %TEMP%\msiexec.exe
- %WINDIR%\syswow64\dlmain.dll
- %WINDIR%\syswow64\dlmon.dll
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\dlmain.dll
- %WINDIR%\syswow64\dlmon.dll
Deletes itself.
Miscellaneous
Creates and executes the following
- '%TEMP%\msiexec.exe' <Full path to file>
- '%TEMP%\msiexec.exe' <Full path to file>' (with hidden window)
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' -nohome' (with hidden window)
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' -nohome
