Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'wd' = '%ProgramFiles%\wd.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im Explorer.exe /f
- '%WINDIR%\syswow64\taskkill.exe' /im taskmgr.exe /f
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\wd.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\errorpagetemplate[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012024041320240414\index.dat
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\down[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\dnserrordiagoff_weboc[1]
- %ProgramFiles%\wd.exe
- %TEMP%\clear.bat
- %WINDIR%\syswow64\rasengine.dat
- %TEMP%\jlfdnf.dll
- %WINDIR%\fonts\jlfdnf.ttf
- %WINDIR%\cb.exe
- %WINDIR%\111.vbs
- %WINDIR%\令人震憾的照片.jpg
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\bullet[1]
Deletes the following files
- %WINDIR%\cb.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\bullet[1]
Network activity
UDP
- DNS ASK ka####sky-com.info
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Media Center Tray Applet' WindowName: ''
- ClassName: '' WindowName: 'View Available Networks'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\111.vbs"
- '%WINDIR%\cb.exe'
- '%WINDIR%\wd.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\clear.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im Explorer.exe /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im taskmgr.exe /f' (with hidden window)
- '%WINDIR%\explorer.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\clear.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im Explorer.exe /f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im taskmgr.exe /f
- '%WINDIR%\explorer.exe'
