W32/Tiotua-P attempts to spread via network shares and peer-to-peer file-sharing applications.
When first run W32/Tiotua-P copies itself to:
<User>\My Documents\Sÿstem.exe
<Root>\New Folder.exe
<Program Files>\Sÿstem.exe
<Root>\WinSys.sys
<Windows>\Sÿstem.exe
<Windows>\Winnt.sys
<System>\Sÿstem.exe
<System>\Winnt.sys
The following registry entry is created to run Sÿstem.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System Init
<System>\Sÿstem.exe
The following registry entries are changed to run Sÿstem.exe on startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe Sÿstem.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe Sÿstem.exe
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SuperHidden
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
DisallowRun
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
1
Wincmd.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
2
zlclient.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
3
nvprotect.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
4
Regworkshop.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
5
Mcshield.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
6
avp.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
7
ccprovsp.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
8
Attrib.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
1
Wincmd.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
2
zlclient.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
3
nvprotect.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
4
Regworkshop.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
5
Mcshield.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
6
avp.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
7
ccprovsp.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun
8
Attrib.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
DisallowRun
1
HKCR\Folder\shell\Explorer\command
(default)
Sÿstem.exe
HKCR\Folder\shell\Open With\command
(default)
Sÿstem.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
0