Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] 'C:\' = ''
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath "C:\Users
Modifies file system
Creates the following files
- %TEMP%\ea4e.tmp\ea4f.tmp\ea50.bat
- nul
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EA4E.tmp\EA4F.tmp\EA50.bat <Full path to file>"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\config\system"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\
- '<SYSTEM32>\attrib.exe' +h "FolderInstall" /s /d
