Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Shadow Defender Daemon' = '"%ProgramFiles%\Shadow Defender\DefenderDaemon.exe" /Auto'
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\diskpt] 'ImagePath' = 'SYSTEM32\drivers\diskpt.sys'
- [HKLM\SYSTEM\CurrentControlSet\Services\diskpt] 'Start' = '00000000'
- [HKLM\System\CurrentControlSet\Services\{0CBD4F48-3751-475D-BE88-4F271385B672}] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\{0CBD4F48-3751-475D-BE88-4F271385B672}] 'ImagePath' = '%ProgramFiles%\Shadow Defender\Service.exe'
Creates the following services
- '{0CBD4F48-3751-475D-BE88-4F271385B672}' %ProgramFiles%\Shadow Defender\Service.exe
Modifies file system
Creates the following files
- C:\kinghaze\x64\cmdtool.txt
- C:\kinghaze\x86\shellext.dll
- C:\kinghaze\x86\uninstall.exe
- %ProgramFiles%\shadow defender\defender.exe
- %ProgramFiles%\shadow defender\defenderdaemon.exe
- %ProgramFiles%\shadow defender\commit.exe
- %ProgramFiles%\shadow defender\cmdtool.exe
- %ProgramFiles%\shadow defender\service.exe
- %ProgramFiles%\shadow defender\shellext.dll
- C:\kinghaze\x86\service.exe
- C:\kinghaze\x86\setup.exe
- %ProgramFiles%\shadow defender\res.ini
- %ProgramFiles%\shadow defender\eula.rtf
- <DRIVERS>\diskpt.sys
- %ProgramFiles%\shadow defender\uninstall.exe
- %ProgramFiles%\shadow defender\user.dat
- %WINDIR%\diskpt.crt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\shadow defender\shadow defender.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\shadow defender\help.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\shadow defender\uninstall shadow defender.lnk
- %ProgramFiles%\shadow defender\cmdtool.txt
- %ProgramFiles%\shadow defender\help.chm
- C:\kinghaze\x86\diskpt.win10.sys
- C:\kinghaze\x86\diskpt.sys
- C:\kinghaze\x86\defender.exe
- C:\kinghaze\x64\help.chm
- C:\kinghaze\x64\res.ini
- C:\kinghaze\x86\cmdtool.txt
- C:\kinghaze\x86\eula.rtf
- C:\kinghaze\x86\help.chm
- C:\kinghaze\x86\res.ini
- C:\kinghaze\kur.exe
- C:\kinghaze\x64\cmdtool.exe
- C:\kinghaze\x64\commit.exe
- C:\kinghaze\x64\eula.rtf
- C:\kinghaze\x64\daemon.exe
- C:\kinghaze\x64\diskpt.sys
- C:\kinghaze\x64\diskpt.win10.sys
- C:\kinghaze\x64\service.exe
- C:\kinghaze\x64\setup.exe
- C:\kinghaze\x64\shellext.dll
- C:\kinghaze\x64\uninstall.exe
- C:\kinghaze\x86\cmdtool.exe
- C:\kinghaze\x86\commit.exe
- C:\kinghaze\x86\daemon.exe
- C:\kinghaze\x64\defender.exe
- C:\users\public\desktop\shadow defender.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\shadow defender.lnk
Deletes the following files
- C:\kinghaze\kur.exe
- C:\kinghaze\x86\setup.exe
- C:\kinghaze\x86\service.exe
- C:\kinghaze\x86\res.ini
- C:\kinghaze\x86\help.chm
- C:\kinghaze\x86\eula.rtf
- C:\kinghaze\x86\diskpt.win10.sys
- C:\kinghaze\x86\diskpt.sys
- C:\kinghaze\x86\defender.exe
- C:\kinghaze\x86\daemon.exe
- C:\kinghaze\x86\commit.exe
- C:\kinghaze\x86\cmdtool.txt
- C:\kinghaze\x86\cmdtool.exe
- C:\kinghaze\x86\shellext.dll
- C:\kinghaze\x64\uninstall.exe
- C:\kinghaze\x64\setup.exe
- C:\kinghaze\x64\service.exe
- C:\kinghaze\x64\res.ini
- C:\kinghaze\x64\help.chm
- C:\kinghaze\x64\eula.rtf
- C:\kinghaze\x64\diskpt.win10.sys
- C:\kinghaze\x64\diskpt.sys
- C:\kinghaze\x64\defender.exe
- C:\kinghaze\x64\daemon.exe
- C:\kinghaze\x64\commit.exe
- C:\kinghaze\x64\cmdtool.txt
- C:\kinghaze\x64\cmdtool.exe
- C:\kinghaze\x64\shellext.dll
- C:\kinghaze\x86\uninstall.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Shadow Defender Daemon Window'
Creates and executes the following
- 'C:\kinghaze\kur.exe'
- 'C:\kinghaze\x64\setup.exe' -silent
- '%ProgramFiles%\shadow defender\service.exe' /install
Executes the following
- '%ProgramFiles%\shadow defender\service.exe' /install' (with hidden window)
