Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\Currentversion\Run] 'svchost' = '%TEMP%\svchost.exe'
Modifies file system
Creates the following files
- %TEMP%\svchost.exe
- nul
Deletes itself.
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ping localhost -n 3 > nul & del "<Full path to file>"' (with hidden window)
- '%TEMP%\svchost.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping localhost -n 3 > nul & del "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' localhost -n 3
