Technical Information
Modifies file system:
Creates the following files:
- %APPDATA%\19981660\svchost.exe
Miscellaneous:
Creates and executes the following:
- '<Full path to file>'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c echo Y|CACLS "%APPDATA%\19981660\svchost.exe" /P "%USERNAME%:R"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Y"
- '<SYSTEM32>\cacls.exe' "%APPDATA%\19981660\svchost.exe" /P "%USERNAME%:R"
- '<SYSTEM32>\cmd.exe' /c echo Y|CACLS "%APPDATA%\19981660" /P "%USERNAME%:R"
- '<SYSTEM32>\cacls.exe' "%APPDATA%\19981660" /P "%USERNAME%:R"
