Technical Information
To ensure autorun and distribution
Substitutes the following executable system files
- <SYSTEM32>\ctfmon.exe with %TEMP%\ctfmon.exe.temp
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Set-MpPreference -DisableRealtimeMonitoring $true
Modifies file system
Creates the following files
- %TEMP%\ctfmon.exe
Moves the following files
- from %TEMP%\ctfmon.exe to %TEMP%\ctfmon.exe.temp
Miscellaneous
Creates and executes the following
- '%TEMP%\ctfmon.exe'
Executes the following
- '<SYSTEM32>\ctfmon.exe'
- '<SYSTEM32>\cmd.exe' /c attrib +h +s +r "<SYSTEM32>\ctfmon.exe"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\ctfmon.exe"
