Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im wuauclt.exe /f
Modifies file system
Creates the following files
- %WINDIR%\fonts\wuauclt.exe
Deletes itself.
Network activity
UDP
- DNS ASK c.##c9.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\fonts\wuauclt.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im wuauclt.exe /f
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im wuauclt.exe /f' (with hidden window)
- '%WINDIR%\fonts\wuauclt.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>"' (with hidden window)
