Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\manera] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\manera] 'ImagePath' = 'C:\manera\manera.exe'
Creates the following services
- 'manera' C:\manera\manera.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Executes the following
- '<SYSTEM32>\taskkill.exe' /IM explorer.exe /F
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- C:\manera\manera.exe
- C:\manera\manera_start.bat
- C:\manera\manera_end.bat
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c C:\manera\manera_start.bat
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCAD /t REG_DWORD /d 1 /f
- '<SYSTEM32>\sc.exe' create manera binPath= "C:\manera\manera.exe" DisplayName= "manera system lock" start= auto
- '<SYSTEM32>\cmd.exe' /c C:\manera\manera_start.bat' (with hidden window)
