Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\temp\temp0.bat" "
- '%TEMP%\is-NJCF0.tmp\Setup.tmp' /SL5="$100E4,1077071,54272,<Current directory>\Setup.exe"
- '<Current directory>\Setup.exe'
Modifies file system:
Creates the following files:
- %TEMP%\is-AETRR.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-AETRR.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-NJCF0.tmp\Setup.tmp
- <Current directory>\Setup.exe
- %WINDIR%\Temp\temp0.bat
Moves itself:
- from <Full path to file> to <Current directory>\Thumb.db
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
