Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\RarSFX0\reg.exe'
- '%TEMP%\RarSFX0\avvio.exe'
Executes the following:
- '<SYSTEM32>\xcopy.exe' "start.vbs" "<SYSTEM32>" /v /c /i /q /g /r /y
- '<SYSTEM32>\shutdown.exe' /r /t 5 /c "Errore nel sitema. Windows verra' riavviato" /f
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\avvio.cmd""
- '<SYSTEM32>\xcopy.exe' "driverUSB.exe" "%WINDIR%" /v /c /i /q /g /r /y
Modifies file system :
Creates the following files:
- %TEMP%\1.tmp\avvio.cmd
- %TEMP%\RarSFX0\start.vbs
- <SYSTEM32>\start.vbs
- %WINDIR%\DriverUSB.exe
- %TEMP%\RarSFX0\chiave.reg
- %TEMP%\RarSFX0\avvio.exe
- %TEMP%\RarSFX0\reg.exe
- %TEMP%\RarSFX0\DriverUSB.exe
Deletes the following files:
- %TEMP%\1.tmp\avvio.cmd
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''