Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows Audio Driver' = '"<SYSTEM32>\audiohd.exe"'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- %WINDIR%\syswow64\audiohd.exe
- %CommonProgramFiles(x86)%\wudhost.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\audiohd.exe
- %CommonProgramFiles(x86)%\wudhost.exe
Network activity
UDP
- DNS ASK de#####putertest.info
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\audiohd.exe'
- '%CommonProgramFiles(x86)%\wudhost.exe'
- '%WINDIR%\syswow64\audiohd.exe' ' (with hidden window)
- '%CommonProgramFiles(x86)%\wudhost.exe' ' (with hidden window)
