Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\hpt
- <SYSTEM32>\tasks\hpm
- <SYSTEM32>\tasks\hpr
Modifies file system
Creates the following files
- %APPDATA%\hptbuju\hptvewe
- %APPDATA%\hptbuju\hpmwewe
- %APPDATA%\hptbuju\hpt
- %HOMEPATH%\log
Miscellaneous
Creates and executes the following
- '%APPDATA%\hptbuju\hptvewe'
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Delete /TN "Hpt" /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Delete /TN "Hpm" /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Delete /TN "Hpr" /F' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Hpt" /F' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Hpm" /F' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Hpr" /F' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /TN "Hpt" /TR %APPDATA%\HptBuju\hptvewe /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /SC MINUTE /TN "Hpt" /TR %APPDATA%\HptBuju\hptvewe /F' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /MO 8 /TN "Hpm" /TR %APPDATA%\HptBuju\hpmwewe /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /SC HOURLY /MO 8 /TN "Hpm" /TR %APPDATA%\HptBuju\hpmwewe /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Create /SC WEEKLY /D MON /TN Hpr /TR "shutdown -r -t 180 -f -c """Atualização Programada, Seu Windows Reiniciara em 3 minutos."""" /ST 12:00 /F' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC WEEKLY /D MON /TN Hpr /TR "shutdown -r -t 180 -f -c """Atualização Programada, Seu Windows Reiniciara em 3 minutos."""" /ST 12:00 /F' (with hidden window)
- '%APPDATA%\hptbuju\hptvewe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Delete /TN "Hpt" /F
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Delete /TN "Hpm" /F
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Delete /TN "Hpr" /F
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Hpr" /F
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Hpm" /F
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "Hpt" /F
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /TN "Hpt" /TR %APPDATA%\HptBuju\hptvewe /F
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /SC MINUTE /TN "Hpt" /TR %APPDATA%\HptBuju\hptvewe /F
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC HOURLY /MO 8 /TN "Hpm" /TR %APPDATA%\HptBuju\hpmwewe /F
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /SC HOURLY /MO 8 /TN "Hpm" /TR %APPDATA%\HptBuju\hpmwewe /F
- '%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Create /SC WEEKLY /D MON /TN Hpr /TR "shutdown -r -t 180 -f -c """Atualização Programada, Seu Windows Reiniciara em 3 minutos."""" /ST 12:00 /F
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC WEEKLY /D MON /TN Hpr /TR "shutdown -r -t 180 -f -c """Atualização Programada, Seu Windows Reiniciara em 3 minutos."""" /ST 12:00 /F
- '<SYSTEM32>\taskeng.exe' {D58D6394-8CAD-4517-BEBA-294C94F69898} S-1-5-21-1960123792-2022915161-3775307078-1001:fudwocuevx\user:Interactive:[1]
