Search
Keyword: microsoft internet explorer
\Software\Microsoft\ Windows\CurrentVersion\Run Client Server Runtime Subsystem = "%All Users Profile%\Windows\csrss.exe" Other System Modifications This Ransomware adds the following registry keys:
Windows operating system versions.) Autostart Technique This Ransomware adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run → If executed without admin rights {File Name of Copy} = %System%\regsvr32.exe /s "
{Random characters} It adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run → If executed without
enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run → If executed without admin rights {File Name of Copy} = %System%\regsvr32.exe /s "
enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run → If executed without admin rights {File Name of Copy} = %System%\regsvr32.exe /s "
enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run → If executed without admin rights {File Name of Copy} = %System%\regsvr32.exe /s "
enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run → If executed without admin rights {File Name of Copy} = %System%\regsvr32.exe /s "
enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run → If executed without admin rights {File Name of Copy} = %System%\regsvr32.exe /s "
enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run → If executed without admin rights {File Name of Copy} = %System%\regsvr32.exe /s "
enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run → If executed without admin rights {File Name of Copy} = %System%\regsvr32.exe /s "
enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run → If executed without admin rights {File Name of Copy} = %System%\regsvr32.exe /s "
" → Enables the evaluation of symbolic links for remote-to-remote scenarios in Windows "%System%\cmd.exe" /c "iisreset.exe /stop" → Stops the Internet Information Services (IIS) on a Windows server "%System%
startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Car{5 Random Characters} = {Loader File Path}\{Loader File Name}.exe Backdoor Routine This Trojan Spy executes the following commands
\6F638C1200771EBE0009A1AE7B07D287\6F638C1200771EBE0009A1AE7B07D287 %User Profile%\Application Data\Microsoft\Protect\S-1-5-21-1614895754-436374069-682003330-1003\1cc9ebfa-cf99-4554-8a6f-085f28fd928a %Start Menu%\Programs\Live
C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and
name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and 7.) Autostart Technique This backdoor adds the following
C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista and
HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {random} = "%AppDataLocal%\{random}\{random}.exe" It modifies the following registry entry(ies) to enable its automatic execution at every system
It checks if it has already infected the Microsoft Word global template, Normal.dot by checking for the existence of a registry key. Infected document files are detected by Trend Micro as