Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ICE X' = '"%APPDATA%\ICE X.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'ICE X' = '"%APPDATA%\ICE X.exe"'
- %APPDATA%\microsoft\windows\start menu\programs\startup\ice x.exe
- %APPDATA%\ice x.exe
- %TEMP%\b309.tmp.bat
- '19#.#23.44.138':80
- http://19#.#23.44.138/ice/Script.php
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\B309.tmp.bat"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\B309.tmp.bat"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Set-MpPreference -DisableRealtimeMonitoring $true
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionExtension "@AppDataDir\ICE X.exe"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath ΓÇ£%HOMEPATH%ΓÇ¥