Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%TEMP%\EwszwhVd.exe'
Modifies file system
Creates the following files
- %TEMP%\ewszwhvd.exe
Miscellaneous
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"%TEMP%\EwszwhVd.exe"
- '%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"%TEMP%\EwszwhVd.exe"
