Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Cortana' = '<Full path to file>'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Cortana' = '<Full path to file>'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Command Prompt (CMD)
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\cmd.exe
- %WINDIR%\syswow64\wbem\wmic.exe
Modifies file system
Moves the following files
- from %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk to %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\total commander\uninstall or repair total commander.lnk to %APPDATA%\microsoft\windows\start menu\programs\total commander\uninstall or repair total commander.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\total commander\total commander help.lnk to %APPDATA%\microsoft\windows\start menu\programs\total commander\total commander help.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\total commander\total commander 64 bit.lnk to %APPDATA%\microsoft\windows\start menu\programs\total commander\total commander 64 bit.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk to %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk to %APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\mail.ru\uninstall mail.ru agent.lnk to %APPDATA%\microsoft\windows\start menu\programs\mail.ru\uninstall mail.ru agent.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\mail.ru\mail.ru portal.lnk to %APPDATA%\microsoft\windows\start menu\programs\mail.ru\mail.ru portal.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\mail.ru\mail.ru agent.lnk to %APPDATA%\microsoft\windows\start menu\programs\mail.ru\mail.ru agent.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\icq\uninstall icq.lnk to %APPDATA%\microsoft\windows\start menu\programs\icq\uninstall icq.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\icq\icq.lnk to %APPDATA%\microsoft\windows\start menu\programs\icq\icq.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\icq\icq.com.lnk to %APPDATA%\microsoft\windows\start menu\programs\icq\icq.com.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk to %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk to %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.happy
- from %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk to %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.happy
