Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'MicroMedia' = '%TEMP%\MicroMedia\MediaCenter.exe'
Modifies file system
Creates the following files
- %TEMP%\micromedia\mediacenter.exe
Deletes itself.
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 & del /q "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 & del /q "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1
