Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,"%LOCALAPPDATA%\putty.exe",'
- %TEMP%\_ikjuwwswk.vbs
- %LOCALAPPDATA%\putty.exe
- %TEMP%\<File name>.exe
- DNS ASK dn#.google
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\_Ikjuwwswk.vbs"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Test-Connection 8.8.8.8' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ExclusionPath C:\,'%LOCALAPPDATA%\putty.exe'' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Test-Connection 8.8.8.8
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ExclusionPath C:\,'%LOCALAPPDATA%\putty.exe'