Technical Information
Modifies file system:
Creates the following files:
- %TEMP%\1.tmp\2.tmp\3.vbs
- %APPDATA%\Excel.exe
- %APPDATA%\UltraVNC.ini
- %APPDATA%\run.reg
- %APPDATA%\elevate.cmd
- %APPDATA%\elevate.vbs
- %APPDATA%\lcrcaep.vbe
- %APPDATA%\photos_cascade.jpg
- %APPDATA%\Microsoft-Excel.exe
- %TEMP%\rad61BB6.tmp.vbs
- %TEMP%\rad50946.tmp.cmd
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Excel.exe
- %APPDATA%\UltraVNC.ini
- %APPDATA%\run.reg
- %APPDATA%\elevate.cmd
- %APPDATA%\elevate.vbs
- %APPDATA%\lcrcaep.vbe
- %APPDATA%\photos_cascade.jpg
- %APPDATA%\Microsoft-Excel.exe
Deletes the following files:
- %TEMP%\1.tmp\2.tmp\3.vbs
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "%TEMP%\1.tmp\2.tmp\3.vbs" //Nologo
- '<SYSTEM32>\cscript.exe' "%TEMP%\rad61BB6.tmp.vbs" //B //Nologo
- '<SYSTEM32>\wscript.exe' //nologo "%APPDATA%\elevate.vbs" wscript "%HOMEPATH%\AppData\Roaming\lcrcaep.vbe"
Executes the following:
- '<SYSTEM32>\mspaint.exe' %HOMEPATH%\AppData\Roaming\photos_cascade.jpg
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\rad50946.tmp.cmd" "
- '%WINDIR%\regedit.exe' /s %HOMEPATH%\AppData\Roaming\run.reg
