Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '%APPDATA%\Microsoft\SystemCertificates\Certificates\Windows\system.exe'
- %TEMP%\cf01.tmp\cf12.bat
- %TEMP%\cf01.tmp\cf12.bat
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\CF01.tmp\CF12.bat <Full path to file>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\CF01.tmp\CF12.bat <Full path to file>"
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "System" /d "%APPDATA%\Microsoft\SystemCertificates\Certificates\Windows\system.exe" /f