Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HDMI Video Driver' = '"%APPDATA%\hdmi.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows-Driver Network Component' = '"<SYSTEM32>\WDNHost.exe"'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- %APPDATA%\hdmi.exe
- <SYSTEM32>\wdnhost.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\hdmi.exe
- <SYSTEM32>\wdnhost.exe
Network activity
UDP
- DNS ASK ge###owsers.net
Miscellaneous
Creates and executes the following
- '%APPDATA%\hdmi.exe'
- '<SYSTEM32>\wdnhost.exe'
- '%APPDATA%\hdmi.exe' ' (with hidden window)
- '<SYSTEM32>\wdnhost.exe' ' (with hidden window)
