Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\putty client
- <SYSTEM32>\tasks\putty ssh client
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\puttyclient\puttyclient.exe
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /C "WMIC BIOS GET SERIALNUMBER"
- '<SYSTEM32>\wbem\wmic.exe' BIOS GET SERIALNUMBER
- '<SYSTEM32>\cmd.exe' /C "WMIC DISKDRIVE GET SERIALNUMBER"
- '<SYSTEM32>\wbem\wmic.exe' DISKDRIVE GET SERIALNUMBER
- '<SYSTEM32>\cmd.exe' /C "WMIC CPU GET ProcessorID"
- '<SYSTEM32>\wbem\wmic.exe' CPU GET ProcessorID
- '<SYSTEM32>\cmd.exe' /c "del <Full path to file>"
- '<SYSTEM32>\cmd.exe' /C "WMIC BIOS GET SERIALNUMBER"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "WMIC DISKDRIVE GET SERIALNUMBER"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "WMIC CPU GET ProcessorID"' (with hidden window)
