Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Zemana] 'ImagePath' = 'C:\Zemana.sys'
Creates the following services
- 'Zemana' C:\Zemana.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\addinprocess32.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe
Modifies file system
Creates the following files
- %TEMP%\content\3324-3568-<File name>.exe-13-21-10-804.dump
- %TEMP%\content\3324-3568-<File name>.exe-13-21-11-315.dump
- C:\zemana.sys
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %WINDIR%\zam.krnl.trace
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\addinprocess32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force' (with hidden window)
