Win32.HLLW.Autoruner2.30084

Added to the Dr.Web virus database: 2017-11-09

Virus description added: 2017-11-09

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WordPress' = 'wscript.exe //B "%TEMP%\WordPress.vbs"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WordPress' = 'wscript.exe //B "%TEMP%\WordPress.vbs"'

Creates or modifies the following files:

Creates the following files on removable media:

Malicious functions:

Creates and executes the following:

Executes the following:

'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\metro-wordpress-themes.jpg
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\2.png

Modifies file system:

Creates the following files:

Sets the 'hidden' attribute to the following files:

Network activity:

Connects to:

UDP:

Miscellaneous:

Searches for the following windows: