Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\kms_service.org.url
Modifies file system
Creates the following files
- %HOMEPATH%\documents\kms.exe
- %ALLUSERSPROFILE%\kms\kms_service.exe
- %LOCALAPPDATA%\msfree inc\kmsauto.ini
- %HOMEPATH%\documents\test.test
Deletes the following files
- %HOMEPATH%\documents\test.test
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\documents\kms.exe'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c md "%LOCALAPPDATA%\MSfree Inc"
- '%WINDIR%\syswow64\cmd.exe' /c echo test>>"%HOMEPATH%\Documents\test.test"
- '<SYSTEM32>\cmd.exe' /D /c del /F /Q "test.test"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' -x -s 772
- '%WINDIR%\syswow64\cmd.exe' /c md "%LOCALAPPDATA%\MSfree Inc"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo test>>"%HOMEPATH%\Documents\test.test"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /D /c del /F /Q "test.test"' (with hidden window)
