Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, %TEMP%\WindowsCache\re.bat'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\re.bat
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\re.bat
- %TEMP%\rarsfx0\x.bat
- %TEMP%\rarsfx0\x.vbs
- nul
- %TEMP%\windowscache\re.bat
- \device\harddiskvolume1\boot\bcd.log
- \device\harddiskvolume1\boot\bcd
Miscellaneous
Searches for the following windows
- ClassName: 'Edit' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\X.vbs"
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\X.bat" "
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe, %TEMP%\WindowsCache\re.bat" /f
- '<SYSTEM32>\shutdown.exe' /r /f /t 0
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\X.bat" "' (with hidden window)
Attempts to shut down the Windows operating system.
