Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SecurityHealthService] 'ImagePath' = '<SYSTEM32>\SecurityHealthService.exe'
Modifies file system
Creates the following files
- %TEMP%\aut6e2d.tmp
- %HOMEPATH%\desktop\download free full programs\web site download free full programs.url
- %HOMEPATH%\desktop\download free full programs\important note.txt
- %WINDIR%\temp\tzliumu
- %WINDIR%\temp\aut8a16.tmp
- %TEMP%\defendercontrol\defendercontrol.ini
- %TEMP%\behbsxu
- %TEMP%\aut758c.tmp
- %TEMP%\nsw7291.tmp\nact.dll
- %TEMP%\defendercontrol\defendercontrol.exe
- %TEMP%\nsw7291.tmp\uac.dll
- C:\gecici_proje_klasoru\windows defender devre dışı.reg
- %TEMP%\aut6eed.tmp
- C:\gecici_proje_klasoru\e.exe
- %TEMP%\aut6eae.tmp
- C:\gecici_proje_klasoru\defender kapat.exe
- %TEMP%\aut6e4f.tmp
- C:\gecici_proje_klasoru\k2.png
- %TEMP%\aut6e3e.tmp
- C:\gecici_proje_klasoru\k.png
- %TEMP%\aut6e2e.tmp
- C:\gecici_proje_klasoru\grey.gif
- %HOMEPATH%\desktop\download free full programs\facebook grups free full programs.url
- %HOMEPATH%\desktop\download free full programs\byemir candan - youtube channel.url
Deletes the following files
- %TEMP%\aut6e2d.tmp
- C:\gecici_proje_klasoru\k.png
- C:\gecici_proje_klasoru\grey.gif
- C:\gecici_proje_klasoru\e.exe
- C:\gecici_proje_klasoru\defender kapat.exe
- %TEMP%\nsw7291.tmp\uac.dll
- %TEMP%\nsw7291.tmp\nact.dll
- %WINDIR%\temp\tzliumu
- %WINDIR%\temp\aut8a16.tmp
- %TEMP%\behbsxu
- %TEMP%\aut758c.tmp
- %TEMP%\aut6eed.tmp
- %TEMP%\aut6eae.tmp
- %TEMP%\aut6e4f.tmp
- %TEMP%\aut6e3e.tmp
- %TEMP%\aut6e2e.tmp
- C:\gecici_proje_klasoru\k2.png
- C:\gecici_proje_klasoru\windows defender devre dışı.reg
Substitutes the following files
- %ALLUSERSPROFILE%\ntuser.pol
- %HOMEPATH%\ntuser.pol
- %HOMEPATH%\tempntuser.pol
- %ALLUSERSPROFILE%\tempntuser.pol
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\gecici_proje_klasoru\defender kapat.exe' /S
- '%TEMP%\defendercontrol\defendercontrol.exe'
- '%TEMP%\defendercontrol\defendercontrol.exe' /S 1
- 'C:\gecici_proje_klasoru\e.exe'
- '%WINDIR%\syswow64\regedit.exe' /s "C:\gecici_proje_klasoru\Windows Defender Devre Dışı.reg"' (with hidden window)
Executes the following
- '<SYSTEM32>\ctfmon.exe'
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '%WINDIR%\syswow64\regedit.exe' /s "C:\gecici_proje_klasoru\Windows Defender Devre Dışı.reg"
- '<SYSTEM32>\raserver.exe' /offerraupdate
