Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'services' = '%WINDIR%\services.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Security Center
blocks the following features:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall set opmode DISABLE
- '%WINDIR%\services.exe'
- '<SYSTEM32>\cmd.exe' /c "file.bat"
Modifies file system:
Creates the following files:
- %WINDIR%\services.exe
- %WINDIR%\file.bat
Deletes the following files:
- %WINDIR%\services.exe
Deletes itself.
