Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Registry Key Name' = '%HOMEPATH%\subfolder\filename.vbs -TT'
Malicious functions
Injects code into
the following user processes:
- filename.exe
Modifies file system
Creates the following files
- %HOMEPATH%\subfolder\filename.exe
- %HOMEPATH%\subfolder\filename.vbs
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\subfolder\filename.vbs"
- '%HOMEPATH%\subfolder\filename.exe'
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\subfolder\filename.vbs"' (with hidden window)
- '%HOMEPATH%\subfolder\filename.exe' ' (with hidden window)
