Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\habsdgtkzl] 'ImagePath' = '%TEMP%\habsdgtkzl.sys'
Creates the following services
- 'habsdgtkzl' %TEMP%\habsdgtkzl.sys
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 1028
Modifies file system
Creates the following files
- %TEMP%\habsdgtkzl.sys
- <Current directory>\del_exe.bat
Deletes the following files
- %TEMP%\habsdgtkzl.sys
Deletes itself.
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <Current directory>\Del_exe.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <Current directory>\Del_exe.bat
