Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '04097601X642625420939bsh' = 'C:\04097601X642625420939bsh\04097601X642625420939bsh.exe "C:\04097601X642625420939bsh\04097601X642625420939b...
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'update04097601X642625420939bsh' = 'C:\04097601X642625420939bsh\04097601X642625420939bsh.exe /AutoIt3ExecuteScript "C:\04097601X6426254209...
Creates the following files on removable media
- <Drive name for removable media>:\happy04097601x642625420939bsh\04097601x642625420939bsh.exe
- <Drive name for removable media>:\happy04097601x642625420939bsh\04097601x642625420939bsh.txt
- <Drive name for removable media>:\happy04097601x642625420939bsh\new 04097601x642625420939bsh.lnk
Modifies file system
Creates the following files
- <Current directory>\04097601x642625420939bsh\04097601x642625420939bsh.exe
- D:\happy04097601x642625420939bsh\new 04097601x642625420939bsh.lnk
- D:\happy04097601x642625420939bsh\04097601x642625420939bsh.txt
- D:\happy04097601x642625420939bsh\04097601x642625420939bsh.exe
- <Current directory>\new yohdn.lnk
- %WINDIR%\new windows.lnk
- C:\users\new users.lnk
- C:\totalcmd\new totalcmd.lnk
- C:\recovery\new recovery.lnk
- %PROGRAMDATA%\new programdata.lnk
- %ProgramFiles(x86)%\new program files (x86).lnk
- %ProgramFiles%\new program files.lnk
- C:\perflogs\new perflogs.lnk
- C:\msocache\new msocache.lnk
- C:\happy04097601x642625420939bsh\new happy04097601x642625420939bsh.lnk
- C:\far2\new far2.lnk
- C:\documents and settings\new documents and settings.lnk
- C:\04097601x642625420939bsh\new 04097601x642625420939bsh.lnk
- C:\$recycle.bin\new $recycle.bin.lnk
- C:\happy04097601x642625420939bsh\04097601x642625420939bsh.txt
- C:\happy04097601x642625420939bsh\04097601x642625420939bsh.exe
- C:\04097601x642625420939bsh\04097601x642625420939bsh.txt
- C:\04097601x642625420939bsh\04097601x642625420939bsh.exe
- <Current directory>\04097601x642625420939bsh\04097601x642625420939bsh.txt
- D:\$recycle.bin\new $recycle.bin.lnk
- D:\happy04097601x642625420939bsh\new happy04097601x642625420939bsh.lnk
Miscellaneous
Creates and executes the following
- '<Current directory>\04097601x642625420939bsh\04097601x642625420939bsh.exe' /AutoIt3ExecuteScript "<Current directory>\04097601X642625420939bsh\04097601X642625420939bsh.txt"
- 'C:\04097601x642625420939bsh\04097601x642625420939bsh.exe' /AutoIt3ExecuteScript C:\04097601X642625420939bsh\04097601X642625420939bsh.txt
- 'C:\04097601x642625420939bsh\04097601x642625420939bsh.exe' C:\04097601X642625420939bsh\04097601X642625420939bsh.txt
- 'C:\04097601x642625420939bsh\04097601x642625420939bsh.exe' /AutoIt3ExecuteScript C:\04097601X642625420939bsh\04097601X642625420939bsh.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start C:\04097601X642625420939bsh\04097601X642625420939bsh.exe C:\04097601X642625420939bsh\04097601X642625420939bsh.txt' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c start C:\04097601X642625420939bsh\04097601X642625420939bsh.exe C:\04097601X642625420939bsh\04097601X642625420939bsh.txt
