Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\z.vbs
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c echo on error resume next:CreateObject("WScript.Shell").Run """<LS_APPDATA>\conhost.exe""",1: >"%HOMEPATH%\Start Menu\Programs\Startup\z.vbs"
- '<LS_APPDATA>\conhost.exe'
- '<SYSTEM32>\cmd.exe' /c echo on error resume next:CreateObject("WScript.Shell").Run """<Full path to file>""",1: >"%HOMEPATH%\Start Menu\Programs\Startup\z.vbs"
Modifies file system:
Creates the following files:
- <LS_APPDATA>\conhost.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Progman' WindowName: ''
