Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\microsoft update.lnk
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
- iexplore.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\aut2413.tmp
- D:\lock.system volume information
- D:\lock.$recycle.bin
- %LOCALAPPDATA%\lock.thunderbird
- %LOCALAPPDATA%\lock.temporary internet files
- %LOCALAPPDATA%\lock.temp
- %LOCALAPPDATA%\lock.programs
- %APPDATA%\lock.mozilla
- %LOCALAPPDATA%\lock.mozilla
- %LOCALAPPDATA%\lock.microsoft
- %LOCALAPPDATA%\lock.iconcache.db
- %LOCALAPPDATA%\lock.history
- %LOCALAPPDATA%\lock.google
- %LOCALAPPDATA%\lock.application data
- %APPDATA%\lock.thunderbird
- %LOCALAPPDATA%\lock.microsoft help
- %APPDATA%\lock.telegram desktop
- %HOMEPATH%\music\lock.desktop.ini
- C:\users\public\documents\lock.my pictures
- %TEMP%\aut673b.tmp
- %TEMP%\8x8x8
- C:\users\public\videos\lock.sample videos
- C:\users\public\videos\lock.desktop.ini
- C:\users\public\pictures\lock.sample pictures
- C:\users\public\pictures\lock.desktop.ini
- %HOMEPATH%\videos\lock.desktop.ini
- %HOMEPATH%\pictures\lock.desktop.ini
- C:\users\public\documents\lock.my music
- C:\users\public\documents\lock.desktop.ini
- %HOMEPATH%\documents\lock.my videos
- %HOMEPATH%\documents\lock.my pictures
- %HOMEPATH%\documents\lock.my music
- %HOMEPATH%\documents\lock.desktop.ini
- C:\users\public\documents\lock.my videos
- %APPDATA%\lock.microsoft
- %APPDATA%\lock.media center programs
- %APPDATA%\lock.identities
- %HOMEPATH%\desktop\lock.contoso.cer
- %HOMEPATH%\desktop\lock.chromesetup.exe
- %HOMEPATH%\desktop\lock.calc.exe
- %HOMEPATH%\desktop\lock.browse.html
- %HOMEPATH%\desktop\lock.browse.htm
- %HOMEPATH%\desktop\lock.dashborder_96.bmp
- %HOMEPATH%\desktop\lock.archer.avi
- %HOMEPATH%\desktop\lock.alert.html
- %HOMEPATH%\desktop\lock.alert.htm
- %HOMEPATH%\desktop\lock.adhd_and_obesity.docx
- %HOMEPATH%\desktop\lock.about.htm
- %HOMEPATH%\desktop\lock.508softwareandos.doc
- %TEMP%\wkxewio
- %HOMEPATH%\desktop\lock.api-hashmap.html
- %HOMEPATH%\desktop\lock.default.bmp
- %HOMEPATH%\desktop\lock.dashborder_120.bmp
- %HOMEPATH%\desktop\lock.desktop.ini
- %HOMEPATH%\desktop\lock.wrar520.exe
- %HOMEPATH%\desktop\lock.testee.cer
- %HOMEPATH%\desktop\lock.winmine.exe
- %HOMEPATH%\desktop\lock.weeklysheet1215.doc
- %HOMEPATH%\desktop\lock.utorrent.exe
- %HOMEPATH%\desktop\lock.uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\lock.toolbar.bmp
- %HOMEPATH%\desktop\lock.thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\lock.testcertificate.cer
- %HOMEPATH%\desktop\lock.dial.bmp
- %HOMEPATH%\desktop\lock.telegram.lnk
- %HOMEPATH%\desktop\lock.nwfieldnotes1966.docx
- %HOMEPATH%\desktop\lock.ituneshelpunavailable.htm
- %HOMEPATH%\desktop\lock.holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\lock.hanni_umami_chapter.doc
- %HOMEPATH%\desktop\lock.google chrome.lnk
- %TEMP%\wl.jpg
- %TEMP%\x.exe
Deletes the following files
- %TEMP%\aut2413.tmp
- %TEMP%\wkxewio
- %TEMP%\aut673b.tmp
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
