Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\W32Time] 'Start' = '00000002'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\pd_169784805e704688\c_7610718a616c4649\m_0cd757862b90467e\mc.cmd
- %ALLUSERSPROFILE%\pd_169784805e704688\c_7610718a616c4649\m_0cd757862b90467e\mc_run.cmd
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- nul
- %TEMP%\ts_selfcheck_22209_8677.tmp
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\pd_169784805e704688\c_7610718a616c4649\m_0cd757862b90467e\mc.cmd
- %ALLUSERSPROFILE%\pd_169784805e704688\c_7610718a616c4649\m_0cd757862b90467e\mc_run.cmd
Miscellaneous
Executes the following
- '<SYSTEM32>\where.exe' wt.exe
- '<SYSTEM32>\cmd.exe' /d /q /c "%ALLUSERSPROFILE%\pd_169784805e704688\c_7610718a616c4649\m_0cd757862b90467e\MC_run.cmd"
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "$Host.UI.RawUI.WindowTitle=$env:TS_DISPLAY_NAME"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo(%ALLUSERSPROFILE%\pd_169784805e704688\c_7610718a616c4649\m_0cd757862b90467e\MC.cmd "
- '<SYSTEM32>\findstr.exe' /i /c:"%ALLUSERSPROFILE%\pd_169784805e704688\c_7610718a616c4649\"
- '<SYSTEM32>\timeout.exe' /t 1
- '<SYSTEM32>\cmd.exe' /c echo prompt $E|cmd
- '<SYSTEM32>\cmd.exe' /S /D /c" echo prompt $E"
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\mode.com' con: cols=132 lines=52
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\tzautoupdate" /v Start /t REG_DWORD /d 3 /f
- '<SYSTEM32>\sc.exe' config tzautoupdate start= demand
- '<SYSTEM32>\sc.exe' start tzautoupdate
- '<SYSTEM32>\sc.exe' config lfsvc start= demand
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '<SYSTEM32>\sc.exe' start lfsvc
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\lfsvc\Service\Configuration" /v Status /t REG_DWORD /d 1 /f
- '<SYSTEM32>\sc.exe' config W32Time start= auto
- '<SYSTEM32>\net.exe' start W32Time
- '<SYSTEM32>\net1.exe' start W32Time
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" /v Type /t REG_SZ /d NTP /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" /v NtpServer /t REG_SZ /d "time.windows.com,0x9" /f
- '<SYSTEM32>\w32tm.exe' /config /manualpeerlist:"time.windows.com,0x9" /syncfromflags:manual /reliable:no /update
- '<SYSTEM32>\w32tm.exe' /resync /force
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\reg.exe query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v Installed 2>nul | <SYSTEM32>\findstr.exe /i /c:"Installed"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v Installed
- '<SYSTEM32>\findstr.exe' /i /c:"Installed"
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\reg.exe query "HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v Installed 2>nul | <SYSTEM32>\findstr.exe /i /c:"Installed"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v Installed
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\reg.exe query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86" /v Installed 2>nul | <SYSTEM32>\findstr.exe /i /c:"Installed"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86" /v Installed
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\reg.exe query "HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x86" /v Installed 2>nul | <SYSTEM32>\findstr.exe /i /c:"Installed"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x86" /v Installed
