Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im notepad.exe /f
Modifies file system
Creates the following files
- %TEMP%\bt35610.bat
- nul
- C:\logfiles\bsbstart__.txt
Sets the 'hidden' attribute to the following files
- %TEMP%\bt35610.bat
Deletes the following files
- C:\logfiles\bsbstart__.txt
- %TEMP%\bt35610.bat
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\bt35610.bat "<Full path to file>"
- '%WINDIR%\syswow64\mode.com' con cols=136 lines=40
- '%WINDIR%\syswow64\choice.exe' /M Help... /C HCVT /T 3 /D C
- '%WINDIR%\syswow64\net.exe' use q: /delete /y
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\bt35610.bat "<Full path to file>"' (with hidden window)
