Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\defkill] 'ImagePath' = '%TEMP%\def_kill.sys'
Creates the following services
- 'defkill' %TEMP%\\def_kill.sys
- 'defkill' %TEMP%\def_kill.sys
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\defender_poc_v5_log.txt
- %TEMP%\def_kill.sys
Deletes the following files
- %TEMP%\def_kill.sys
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c sc create defkill type= kernel start= demand binPath= "%TEMP%\\def_kill.sys"
- '<SYSTEM32>\sc.exe' create defkill type= kernel start= demand binPath= "%TEMP%\\def_kill.sys"
- '<SYSTEM32>\cmd.exe' /c sc start defkill
- '<SYSTEM32>\sc.exe' start defkill
- '<SYSTEM32>\cmd.exe' /c sc delete defkill
- '<SYSTEM32>\sc.exe' delete defkill
