Technical Information
To ensure autorun and distribution
Substitutes the following executable system files
- <SYSTEM32>\userinit.exe with <SYSTEM32>\userinit.exe
Modifies file system
Deletes the following files
- <SYSTEM32>\userinit.exe
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /k takeown /f <SYSTEM32> && icacls <SYSTEM32> /grant "%username%:F"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /k takeown /f <SYSTEM32> && icacls <SYSTEM32> /grant "%username%:F"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>
- '<SYSTEM32>\icacls.exe' <SYSTEM32> /grant "user:F"
