Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Monitor.exe' = '<Current directory>\Monitor.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\ctfmon.exe
a large number of user processes.
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogoff' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
Modifies file system :
Creates the following files:
- <Current directory>\senha.txt
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: 'Propriedades do sistema'
- ClassName: '(null)' WindowName: 'Lixeira'
- ClassName: '(null)' WindowName: 'Propriedades de V?deo'
- ClassName: '(null)' WindowName: 'Ambiente de Rede'
- ClassName: '(null)' WindowName: 'Propriedade de teclado'
- ClassName: '(null)' WindowName: 'Editor do Registro'
- ClassName: '(null)' WindowName: 'Prompt de commando'
- ClassName: '(null)' WindowName: 'Prompt do Ms-Dos'
- ClassName: '(null)' WindowName: '(C:)'
- ClassName: '(null)' WindowName: 'Gerenciador de Tarefas do Windows'
- ClassName: '(null)' WindowName: 'Propriedade de Sons'
- ClassName: '(null)' WindowName: 'Editor de Registro'
- ClassName: 'ExploreWClass' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Configurar p?gina'
- ClassName: 'CabinetWClass' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Salvar p?gina da Web'
- ClassName: '(null)' WindowName: 'Salvar Como'
- ClassName: '(null)' WindowName: 'Imprimir'
- ClassName: '(null)' WindowName: 'Executar'
- ClassName: '(null)' WindowName: 'Utilit?rio de configura??o do sistema'
- ClassName: '(null)' WindowName: 'Op??es da Internet'
- ClassName: '(null)' WindowName: 'Download de Arquivo - Aviso de Seguran?a'
- ClassName: '(null)' WindowName: 'Download de arquivo'
- ClassName: '(null)' WindowName: 'Gerenciamento do computador'
- ClassName: '(null)' WindowName: 'Tarefas agendadas'
- ClassName: '(null)' WindowName: 'Prompt de comando'
- ClassName: '(null)' WindowName: 'Propriedades de Lixeira'
- ClassName: '(null)' WindowName: 'Confirm Shortcut Delete'
- ClassName: '(null)' WindowName: 'Informa??es sobre o sistema'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Program Manager'
- ClassName: '(null)' WindowName: 'Barra de Endere?os'
- ClassName: '(null)' WindowName: 'dWinlock trial version'
- ClassName: '(null)' WindowName: 'Confirm Folder Delete'
- ClassName: '(null)' WindowName: 'Propriedade de Data e hora'
- ClassName: '(null)' WindowName: 'Propriedades de Barra de tarefas e menu iniciar'
- ClassName: '(null)' WindowName: 'Painel de controle'
- ClassName: '(null)' WindowName: 'Arquivos de Programas'
- ClassName: '(null)' WindowName: 'Meus locais de Rede'
- ClassName: '(null)' WindowName: 'Confirmar exclus?o'
- ClassName: '(null)' WindowName: 'Confirmar exclus?o de v?rios arquivos'
- ClassName: '(null)' WindowName: 'Confirm File Delete'
- ClassName: '(null)' WindowName: 'Confirmar exclus?o de atalho'
- ClassName: '(null)' WindowName: 'Confirmar exclus?o de arquivo'
- ClassName: '(null)' WindowName: 'Confirmar exclus?o de pasta'
