Examples of HPsus/TDLrtk-C include:
Example 1
Runtime Analysis
Copies Itself To
- c:\Documents and Settings\test user\Local Settings\Temp\4.tmp
Dropped Files
Registry Keys Created
- HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- maxhttpredirects
- 0x000022b8
- HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings
- enablehttp1_1
- 0x00000001
- HKLM\SYSTEM\CurrentControlSet\Control\Print\Printers
- DefaultSpoolDirectory
- C:\WINDOWS\System32\spool\PRINTERS
- HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
- svchost.exe
- 0x000022b8
Registry Keys Modified
- HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- CurrentLevel
- 0x00000000
- HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- CurrentLevel
- 0x00000000
Processes Created
- c:\windows\system32\spoolsv.exe
Example 2
File Information
- File type
- application/x-ms-dos-executable