Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender' = '"%APPDATA%\Microsoft\Windows Defender\defender.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Host-process' = '"%APPDATA%\Microsoft\Network\Connections\hostdl.exe"'
Modifies file system:
Creates the following files:
- %APPDATA%\Microsoft\Internet Explorer\History
- %APPDATA%\Microsoft\Network\Connections\hostdl.exe
- %TEMP%\r3lease21j.exe
- <Current directory>\abc.exe
- <Current directory>\0.bat
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Microsoft\Network\Connections\hostdl.exe
- %APPDATA%\Microsoft\Internet Explorer\History
Deletes the following files:
- %TEMP%\r3lease21j.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%APPDATA%\Microsoft\Network\Connections\hostdl.exe' "%TEMP%\r3lease21j.exe"
- '%TEMP%\r3lease21j.exe'
- '<Current directory>\abc.exe' -p123 -d%HOMEPATH%\Local Settings\Temp
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""<Current directory>\0.bat" "
