Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinShell' = 'C:\WinShell\WinSeven.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- C:\winshell\winseven.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\taskhost.exe
Miscellaneous
Creates and executes the following
- 'C:\winshell\winseven.exe'
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinShell /t REG_SZ /d C:\WinShell\WinSeven.exe /f' (with hidden window)
- 'C:\winshell\winseven.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinShell /t REG_SZ /d C:\WinShell\WinSeven.exe /f
