Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '%APPDATA%\Winlock.exe'
Modifies file system
Creates the following files
- %APPDATA%\winlock.exe
- %APPDATA%\unlock.exe
- \device\harddiskvolume1\boot\bcd.log
- \device\harddiskvolume1\boot\bcd
Miscellaneous
Creates and executes the following
- '%APPDATA%\winlock.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c sc start BlockAllAccess
- '<SYSTEM32>\sc.exe' start BlockAllAccess
Attempts to shut down the Windows operating system.
