Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Smonitor1.12.2.exe' = 'C:/windows/Smonitor1.12.2.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Smonitor1.12.2.exe' = 'C:/windows/Smonitor1.12.2.exe'
- [<HKLM>\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'Smonitor1.12.2.exe' = 'C:/windows/Smonitor1.12.2.exe'
Modifies file system
Creates the following files
- %TEMP%\1a91.tmp\1aa2.tmp\1aa3.vbs
- %TEMP%\29cd.tmp\29ce.tmp\29cf.vbs
- %TEMP%\27f9.tmp\281a.tmp\282a.vbs
- %TEMP%\230a.tmp\231a.tmp\232b.bat
- <SYSTEM32>\1aa3.vbs
- %WINDIR%\1aa3.vbs
- <Current directory>\winio32.sys
- <Current directory>\win.exe
- <Current directory>\while.exe
- <Current directory>\task.exe
- <Current directory>\smonitor1.12.2.exe
- <Current directory>\sj.exe
- <Current directory>\po.sys
- <Current directory>\mbrchange.exe
- <Current directory>\ld.exe
- <Current directory>\ieclose.exe
- <Current directory>\hz.exe
- <Current directory>\hp.exe
- <Current directory>\co.exe
- <Current directory>\blue.exe
- %WINDIR%\282a.vbs
- <SYSTEM32>\282a.vbs
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' %TEMP%\1A91.tmp\1AA2.tmp\1AA3.vbs //Nologo
- '<Current directory>\hz.exe'
- '<SYSTEM32>\wscript.exe' %TEMP%\29CD.tmp\29CE.tmp\29CF.vbs //Nologo
- '<SYSTEM32>\wscript.exe' %TEMP%\27F9.tmp\281A.tmp\282A.vbs //Nologo
- '<Current directory>\ld.exe'
- '<Current directory>\task.exe'
- '<Current directory>\smonitor1.12.2.exe'
- '<Current directory>\co.exe'
- '<Current directory>\mbrchange.exe'
- '<SYSTEM32>\cmd.exe' /c start ld.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c start task.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c start Smonitor1.12.2.exe' (with hidden window)
- '<SYSTEM32>\wscript.exe' %TEMP%\27F9.tmp\281A.tmp\282A.vbs //Nologo' (with hidden window)
- '<SYSTEM32>\wscript.exe' %TEMP%\1A91.tmp\1AA2.tmp\1AA3.vbs //Nologo' (with hidden window)
- '<SYSTEM32>\wscript.exe' %TEMP%\29CD.tmp\29CE.tmp\29CF.vbs //Nologo' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c start tray.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c start hz.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c start mbrchange.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c start co.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\230A.tmp\231A.tmp\232B.bat <Current directory>\mbrchange.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c start mbrchange.exe
- '<SYSTEM32>\cmd.exe' /c start Smonitor1.12.2.exe
- '<SYSTEM32>\cmd.exe' /c start task.exe
- '<SYSTEM32>\cmd.exe' /c start ld.exe
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\230A.tmp\231A.tmp\232B.bat <Current directory>\mbrchange.exe"
- '<SYSTEM32>\diskpart.exe'
- '<SYSTEM32>\cmd.exe' /c start tray.exe
- '<SYSTEM32>\vds.exe'
- '<SYSTEM32>\cmd.exe' /c start hz.exe
- '<SYSTEM32>\cmd.exe' /c start co.exe
