Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\SysHealthMonitor] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\SysHealthMonitor] 'ImagePath' = '%ALLUSERSPROFILE%\SysHealthMonitor\shmon.exe'
Creates the following services
- 'SysHealthMonitor' %ALLUSERSPROFILE%\SysHealthMonitor\shmon.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\syshealthmonitor\shmon.exe
Network activity
Connects to
- '1.#.1.1':443
- '10#.#1.56.236':443
TCP
Other
- '1.#.1.1':443
- '10#.#1.56.236':443
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\syshealthmonitor\shmon.exe'
