Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\htafile\Shell\Open\Command] '' = '<SYSTEM32>\mshta.exe "%1" %*'
- [<HKLM>\Software\Classes\wcsfile\shell\open\command] '' = 'PECMD.EXE LOAD "%L"'
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\regedit.exe
- <SYSTEM32>\wbem\mofcomp.exe
- <SYSTEM32>\ntprint.exe
- <SYSTEM32>\net.exe
- <SYSTEM32>\pnputil.exe
Modifies file system
Creates the following files
- C:\users\public\libraries\~ecordedtv.tmp
- %WINDIR%\boot_usb
- %APPDATA%\microsoft\windows\start menu\programs\devices and printers\add printer wizard.lnk
- %APPDATA%\microsoft\windows\start menu\programs\devices and printers\add printer driver.lnk
- %APPDATA%\microsoft\windows\start menu\programs\devices and printers\print server properties.lnk
- %HOMEPATH%\desktop\add printer wizard.lnk
Modifies the following files
- C:\users\public\desktop\desktop.ini
- C:\users\public\desktop.ini
- C:\users\desktop.ini
- C:\users\public\music\sample music\desktop.ini
- C:\users\public\documents\desktop.ini
- C:\users\public\libraries\desktop.ini
- C:\users\public\downloads\desktop.ini
- C:\users\public\videos\sample videos\desktop.ini
- C:\users\public\pictures\sample pictures\desktop.ini
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\desktop.ini
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\desktop.ini
- C:\users\public\music\desktop.ini
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\desktop.ini
- C:\users\public\pictures\desktop.ini
- C:\users\public\videos\desktop.ini
- %ALLUSERSPROFILE%\microsoft\windows\start menu\desktop.ini
- %ProgramFiles(x86)%\desktop.ini
Substitutes the following files
- C:\Users\Public\Libraries\RecordedTV.library-ms
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '<Full path to file>' LOAD *qk #20:INDATA U 32768' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ren Run.dll Run.cmd' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ren Config.dll Config.cmd' (with hidden window)
- '%WINDIR%\regedit.exe' /s %WINDIR%\Inf\Usb1.inf' (with hidden window)
- '%WINDIR%\regedit.exe' /s Mouseadd.sys' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo Copyright@NasiBoot 2022>%WINDIR%\Boot_USB' (with hidden window)
- '<SYSTEM32>\wbem\mofcomp.exe' <SYSTEM32>\wbem\win32_printer.mof >null' (with hidden window)
- '<SYSTEM32>\wbem\mofcomp.exe' <SYSTEM32>\wbem\PrintManagementProvider.mof >null' (with hidden window)
- '<SYSTEM32>\net.exe' start spooler' (with hidden window)
- '<SYSTEM32>\msiexec.exe' /register' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ren Config.CMD Config.dll' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ren Run.CMD Run.DLL' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C ren Run.dll Run.cmd
- '<SYSTEM32>\cmd.exe' /C ren Config.dll Config.cmd
- '%WINDIR%\regedit.exe' /s %WINDIR%\Inf\Usb1.inf
- '%WINDIR%\regedit.exe' /s Mouseadd.sys
- '%WINDIR%\regedit.exe' /s %ProgramFiles(x86)%\Classic Shell\StartMenu.dll
- '<SYSTEM32>\cmd.exe' /c echo Copyright@NasiBoot 2022>%WINDIR%\Boot_USB
- '<SYSTEM32>\wbem\mofcomp.exe' <SYSTEM32>\wbem\win32_printer.mof >null
- '<SYSTEM32>\wbem\mofcomp.exe' <SYSTEM32>\wbem\PrintManagementProvider.mof >null
- '<SYSTEM32>\ntprint.exe'
- '<SYSTEM32>\net.exe' start spooler
- '<SYSTEM32>\net1.exe' start spooler
- '<SYSTEM32>\pnputil.exe' -i -a "%WINDIR%\inf\usbprint.inf"
- '<SYSTEM32>\msiexec.exe' /register
- '<SYSTEM32>\cmd.exe' /C ren Config.CMD Config.dll
- '<SYSTEM32>\cmd.exe' /C ren Run.CMD Run.DLL
