Technical Information
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\autdb31.tmp
- %WINDIR%\system\nodesktop.reg
- %TEMP%\autdb42.tmp
- %WINDIR%\system\netyh.exe
Deletes the following files
- %TEMP%\autdb31.tmp
- %TEMP%\autdb42.tmp
- %WINDIR%\system\netyh.exe
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%WINDIR%\system\netyh.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 2&del /q/s "%WINDIR%\system\netyh.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 2&del /q/s "%WINDIR%\system\netyh.exe"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2
- '%WINDIR%\syswow64\regedit.exe' /s %WINDIR%\system\nodesktop.reg
