Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft' = '%TEMP%\aero.exe'
Modifies file system
Creates the following files
- %TEMP%\log.txt
- %TEMP%\temp.bat
Moves itself
- from <Full path to file> to %TEMP%\aero.exe
Network activity
Connects to
- '62.##9.27.197':80
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c temp.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c temp.bat
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Microsoft" /t REG_SZ /F /D %TEMP%\aero.exe
