Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OWDrdbvHvdWmk' = '%ALLUSERSPROFILE%\OWDrdbvHvdWmk.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq...
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\owdrdbvhvdwmk.exe
Moves itself
- from <Full path to file> to %TEMP%\tmpea8d.tmp
Network activity
Connects to
- 'fi###hin.org':80
UDP
- DNS ASK se###happle.org
- DNS ASK se####belief.org
- DNS ASK cl###calm.org
- DNS ASK fi###hin.org
- DNS ASK se###hways.org
- DNS ASK fi####vertisem.org
- DNS ASK se####modern.org
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\owdrdbvhvdwmk.exe'
