Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im sql*
- '<SYSTEM32>\taskkill.exe' /f /im oracle*
- '<SYSTEM32>\taskkill.exe' /f /im mysq*
- '<SYSTEM32>\taskkill.exe' /f /im chrome*
- '<SYSTEM32>\taskkill.exe' /f /im veeam*
- '<SYSTEM32>\taskkill.exe' /f /im firefox*
- '<SYSTEM32>\taskkill.exe' /f /im excel*
- '<SYSTEM32>\taskkill.exe' /f /im msaccess*
- '<SYSTEM32>\taskkill.exe' /f /im onenote*
- '<SYSTEM32>\taskkill.exe' /f /im outlook*
- '<SYSTEM32>\taskkill.exe' /f /im powerpnt*
- '<SYSTEM32>\taskkill.exe' /f /im winword*
- '<SYSTEM32>\taskkill.exe' /f /im wuauclt*
Launches a large number of processes
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- nul
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 2
