TrojanDropper:Win32/QQpass.gen!D

Installation

• Copies itself as "<name>.ime" under a directory in %program_files%. The file name used differs between variants.
• Drops file "<name>.sys" under the same directory in %program_files%
  This file is not actually a system driver, but a com object, that the target injects into each process that gets executed after the infection occurs.
• Modifies the following registry entries:
  Sets value: "(default)"
  With data: "0"
  To key: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{<random_clsid>}
  
  Sets value: "(default)"
  With data: "%program_files%\...\<name>.sys"
  To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{<random_clsid>}\InProcServer32
  
  Sets value: "{<random_clsid>}"
  With data: "0"
  To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

Payload