Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\PSMSQL] 'ImagePath' = '\Restaurant Processor\microsys.exe -service'
- [<HKLM>\SYSTEM\ControlSet001\Services\PSMSQL] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '<SYSTEM32>\sc.exe' start PSMSQL
- 'C:\Restaurant Processor\microsys.exe' -service
- 'C:\Restaurant Processor\microsys.exe' "-melt <Full path to file> -service"
- '<SYSTEM32>\cmd.exe' /C sc start PSMSQL
Modifies file system:
Creates the following files:
- <Current directory>\<File name>.pdf
- C:\Restaurant Processor\nexus.dat
- C:\Restaurant Processor\microsys.exe
