Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im cmd.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %WINDIR%\zm.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /k regsvr32 /s %WINDIR%\zm.dll zm.dll
- '%WINDIR%\syswow64\cmd.exe' /k taskkill /f /t /im cmd.exe
- '%WINDIR%\syswow64\regsvr32.exe' /s %WINDIR%\zm.dll zm.dll
- '%WINDIR%\syswow64\cmd.exe' /k regsvr32 /s %WINDIR%\zm.dll zm.dll' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k taskkill /f /t /im cmd.exe' (with hidden window)
