Examples of W32/Autorun-BZM include:
Example 1
File Information
- Size
- 264K
- SHA-1
- 634cd533e212728f231c2dc20459d3b4dc5cc964
- MD5
- eeee73f475465318d96c6a898b803c4f
- CRC-32
- f8393591
- File type
- Windows executable
- First seen
- 2012-12-05
Example 2
File Information
- Size
- 264K
- SHA-1
- 7d33de1db17075ad1c7f75cb8c543965ed0bb616
- MD5
- 4ec7bb49eca97aec9b0dab2bac2b0d40
- CRC-32
- 4843d074
- File type
- Windows executable
- First seen
- 2012-12-05
Runtime Analysis
Copies Itself To
- F:/Secret.exe
- F:/hiaiv.exe
- c:\Documents and Settings\test user\hiaiv.exe
Dropped Files
- F:/Porn.exe
- Size
- 264K
- SHA-1
- 634cd533e212728f231c2dc20459d3b4dc5cc964
- MD5
- eeee73f475465318d96c6a898b803c4f
- CRC-32
- f8393591
- File type
- Windows executable
- First seen
- 2012-12-05
- F:/Sexy.exe
- Size
- 264K
- SHA-1
- b321c2861a0d830f55aaf7a16fd570600df96faa
- MD5
- 6c7dcfe9d2d8a5957fed39af451dae8b
- CRC-32
- fddfde70
- File type
- Windows executable
- First seen
- 2012-12-05
- F:/Passwords.exe
- Size
- 264K
- SHA-1
- d8b0006e9fb5eb86b435ce6275a283243a48d7c1
- MD5
- 67cee87ec4085fad8610d42410bcd00c
- CRC-32
- fd2e54d3
- File type
- Windows executable
- First seen
- 2012-12-05
Registry Keys Created
- HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
- NoAutoUpdate
- 0x00000001
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- hiaiv
- c:\Documents and Settings\test user\hiaiv.exe /f
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- ShowSuperHidden
- 0x00000000
Processes Created
- c:\Documents and Settings\test user\hiaiv.exe
Example 3
File Information
- Size
- 264K
- SHA-1
- b321c2861a0d830f55aaf7a16fd570600df96faa
- MD5
- 6c7dcfe9d2d8a5957fed39af451dae8b
- CRC-32
- fddfde70
- File type
- Windows executable
- First seen
- 2012-12-05