Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MyProgram' = '<Full path to file>'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\myprogram.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\myprogram.bat
- <SYSTEM32>\tasks\myprogramtask
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- nul
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MyProgram /t REG_SZ /d "<Full path to file>" /f
- '<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MyProgram /t REG_SZ /d "<Full path to file>" /f
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn "MyProgramTask" /tr "<Full path to file>" /sc onlogon /rl highest /f
- '<SYSTEM32>\schtasks.exe' /create /tn "MyProgramTask" /tr "<Full path to file>" /sc onlogon /rl highest /f
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM explorer.exe >nul 2>&1
