Technical Information
Malicious functions:
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
- '<SYSTEM32>\cmd.exe' /c echo on error resume next:CreateObject("WScript.Shell").Run "<Full path to file>",1: >"%HOMEPATH%\Start Menu\Programs\Startup\x.vbs"
Injects code into
the following user processes:
- IEXPLORE.EXE
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Progman' WindowName: ''
