Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wd' = '%TEMP%\wd.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\wd
- %APPDATA%\microsoft\windows\start menu\programs\startup\wd.lnk
Modifies file system
Creates the following files
- %TEMP%\925515.exe
- %TEMP%\wd.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\wd.exe.log
Network activity
Connects to
- '45.##0.128.141':7000
Miscellaneous
Creates and executes the following
- '%TEMP%\925515.exe'
- '%TEMP%\wd.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /f /RL HIGHEST /sc minute /mo 1 /tn "wd" /tr "%TEMP%\wd.exe"
- '<SYSTEM32>\schtasks.exe' /create /f /RL HIGHEST /sc minute /mo 1 /tn "wd" /tr "%TEMP%\wd.exe"' (with hidden window)
