Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Security2e5f' = '<Full path to file>'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SysSecurity2e5f' = '<Full path to file>'
Creates or modifies the following files
- <SYSTEM32>\tasks\updatee7dd87
- %APPDATA%\microsoft\windows\start menu\programs\startup\system62f84.lnk
Modifies file system
Creates the following files
- <SYSTEM32>\3a21f4b2.exe
- %WINDIR%\syswow64\beb8f249.exe
- %APPDATA%\microsoft\windows\0f8706a6.exe
- nul
- %TEMP%\d397bd74.exe
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\3a21f4b2.exe
- %WINDIR%\syswow64\beb8f249.exe
- %APPDATA%\microsoft\windows\0f8706a6.exe
- %TEMP%\d397bd74.exe
Miscellaneous
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn Updatee7dd87 /tr <Full path to file> /sc hourly /st 00:00 /f
- '<SYSTEM32>\attrib.exe' +h <SYSTEM32>\3a21f4b2.exe
- '<SYSTEM32>\attrib.exe' +h %WINDIR%\SysWOW64\beb8f249.exe
- '<SYSTEM32>\attrib.exe' +h %APPDATA%\Microsoft\Windows\0f8706a6.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command " $s = New-Object -comObject WScript.Shell $l = $s.CreateShortcut(\"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\System62f84.lnk\") $l.TargetPath = \"<Full path to fil...
- '<SYSTEM32>\attrib.exe' +h %TEMP%\d397bd74.exe
