Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%TEMP%\Windows\name.exe.lnk'
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%TEMP%\WinRing0x64.sys'
- %TEMP%\tmp.exe
- %TEMP%\.exe
- %TEMP%\windows\name.exe
- 'po##.#upportxmr.com':3333
- DNS ASK po##.#upportxmr.com
- '%TEMP%\tmp.exe'
- '%WINDIR%\syswow64\cmd.exe' /c copy "C:/lrewl/<File name>.exe" "%temp%\Windows\name.exe" /Y' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\Windows\name.exe.lnk" /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy "C:/lrewl/<File name>.exe" "%temp%\Windows\name.exe" /Y
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\Windows\name.exe.lnk" /f
- '%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%TEMP%\Windows\name.exe.lnk" /f