Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im firefox.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system:
Creates the following files:
- %TEMP%\RarSFX0\reg.bat
- %TEMP%\RarSFX0\regRun.bat
- %TEMP%\RarSFX0\rg.reg
- %TEMP%\RarSFX0\start.vbs
- %TEMP%\RarSFX0\files.exe
- %TEMP%\RarSFX0\r.bat
Deletes the following files:
- %TEMP%\RarSFX0\regRun.bat
- %TEMP%\RarSFX0\rg.reg
- %TEMP%\RarSFX0\start.vbs
- %TEMP%\RarSFX0\files.exe
- %TEMP%\RarSFX0\r.bat
- %TEMP%\RarSFX0\reg.bat
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\start.vbs"
Executes the following:
- '%WINDIR%\regedit.exe' -s rg.reg "%TEMP%\$DelCache$.reg"
- '<SYSTEM32>\cmd.exe' /c "r.bat"
- '<SYSTEM32>\cmd.exe' /c "regRun.bat"
