Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinBioPlugIns2' = '"%APPDATA%\notepad.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\winbioplugins2
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\isolated storage\fc7076bb\59fd041e
- %APPDATA%\notepad.exe
- %TEMP%\tmp3c44.tmp.bat
- %APPDATA%\visualelements\lpt5\notepad
- nul
Sets the 'hidden' attribute to the following files
- <Full path to file>
Deletes the following files
- %APPDATA%\notepad.exe
Substitutes the following files
- %APPDATA%\notepad.exe
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn "WinBioPlugIns2" /tr "%APPDATA%\VisualElements\LPT5\notepad"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c md \\?\%APPDATA%\VisualElements\LPT5\
- '<SYSTEM32>\cmd.exe' /c SCHTASKS /Create /SC MINUTE /MO 180 /TN "WinBioPlugIns2" /TR %APPDATA%\VisualElements\LPT5\notepad
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 180 /TN "WinBioPlugIns2" /TR %APPDATA%\VisualElements\LPT5\notepad
- '<SYSTEM32>\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn "WinBioPlugIns2" /tr "%APPDATA%\VisualElements\LPT5\notepad"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmp3C44.tmp.bat""
- '<SYSTEM32>\cmd.exe' /c copy %APPDATA%\notepad.exe %APPDATA%\VisualElements\LPT5\notepad
- '<SYSTEM32>\timeout.exe' 3
