Behavior Details

1. Files Added/Modified:
C:\Windows\System32\config\systemprofile\AppData\Roaming\Images\tmp.ini
C:\Windows\Temp\nsaC407.tmp\inetc.dll

2. Registry Keys Added/Modified:
Adds data
C:\Windows\system32\config\systemprofile\AppData\Roaming\Images\image.exe
under [Persistence / Auto-Run]
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\Coin

3. Network Activity:
• IP Communications:
54.37.84.221:3333
65.108.204.181:3333

• DNS Requests:
testswork[.]ru
mine[.]moneropool[.]com -> 65.108.204.181
xmr[.]hashinvest[.]net
monero[.]crypto-pool[.]fr -> 54.37.84.221

4. Services & Scheduled Tasks Created:
Service: WSearch

Removal Instructions

1. Update K7 security to the latest version.
2. Open Windows registry editor and delete the following keys:
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
3. Restart the machine.