Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'dhre49' = '<SYSTEM32>\.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '<SYSTEM32>\\services.exe'
Modifies file system
Creates the following files
- %WINDIR%\syswow64\†\scservice.exe
- %WINDIR%\syswow64\†\dhre49.exe
- %WINDIR%\syswow64\†\servicess.exe
- %WINDIR%\syswow64\†\mirror.exe
- %WINDIR%\syswow64\†\netdhcp.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\†\scservice.exe
- %WINDIR%\syswow64\†\dhre49.exe
- %WINDIR%\syswow64\†\servicess.exe
- %WINDIR%\syswow64\†\mirror.exe
- %WINDIR%\syswow64\†\netdhcp.exe
