Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Injects code into
the following system processes:
- %WINDIR%\twunk_32.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\server.exe
- %TEMP%\twain.log
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\server.exe'
- '%LOCALAPPDATA%\server.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\twunk_32.exe'
