Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\software\microsoft\windows\currentversion\Run] 'WinampNew' = '%APPDATA%\WinampNew\WinampNew.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
- Windows Action Center
modifies the following system settings:
- Hides taskbar notifications
Modifies file system
Creates the following files
- %TEMP%\6136594b32.tmp
- %TEMP%\53695a4f64.tmp
- %TEMP%\6331793350.tmp
- %TEMP%\5a34465042.tmp
- %TEMP%\647955777a.tmp
- %APPDATA%\winampnew\winampnew.exe
Deletes itself.
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $key='HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Pre...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AllowTele...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $key='HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Pre...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AllowTele...
Attempts to shut down the Windows operating system.
