Technical Information
Malicious functions
Executes the following (exploit)
- '%WINDIR%\explorer.exe' <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\npmo.dat
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: '<SYSTEM32>\cmd.exe'
- ClassName: '' WindowName: 'Administrator: <SYSTEM32>\cmd.exe'
Creates and executes the following
- '%WINDIR%\explorer.exe' <SYSTEM32>\cmd.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe'
