Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Defender' = '"%APPDATA%\Microsoft\Windows Defender\defender.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Host-process' = '"%APPDATA%\Microsoft\Network\Connections\hostdl.exe"'
Modifies file system:
Creates the following files:
- %APPDATA%\Microsoft\Network\Connections\hostdl.exe
- %APPDATA%\Microsoft\Internet Explorer\History
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Microsoft\Network\Connections\hostdl.exe
- %APPDATA%\Microsoft\Internet Explorer\History
Deletes the following files:
- <Full path to file>
Miscellaneous:
Creates and executes the following:
- '%APPDATA%\Microsoft\Network\Connections\hostdl.exe' "<Full path to file>"
