Trojan.DownLoader26.3082

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'spmunderestimation' = '"%ProgramFiles%\prewired\visigoths.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'underestimationspm' = '"%ProgramFiles%\prewired\visigoths.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'spm' = '"%ProgramFiles%\Biomaterial\schoolcraft.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'underestimationunderestimation' = '"%ProgramFiles%\Logins\schoolcraft.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'affaires' = '"%ProgramFiles%\Biomaterial\schoolcraft.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'internship' = '"%ProgramFiles%\gwyneth\internship.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'spmspm' = '"%ProgramFiles%\Logins\schoolcraft.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'merrymanwheelbase' = '"%ProgramFiles%\prewired\visigoths.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wheelbase' = '"%ProgramFiles%\Biomaterial\schoolcraft.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'merryman' = '"%ProgramFiles%\Biomaterial\schoolcraft.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wheelbasemerryman' = '"%ProgramFiles%\prewired\visigoths.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'underestimation' = '"%ProgramFiles%\Biomaterial\schoolcraft.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wheelbasewheelbase' = '"%ProgramFiles%\Logins\schoolcraft.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'merrymanmerryman' = '"%ProgramFiles%\Logins\schoolcraft.exe"'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\brittanicabrittanica.lnk
%HOMEPATH%\Start Menu\Programs\Startup\brittanica.lnk

Malicious functions:

Executes the following:

'<SYSTEM32>\taskkill.exe' /im chrome.exe

Modifies file system:

Creates the following files:

%ProgramFiles%\premeditation\premeditation.exe
%TEMP%\nsx7.tmp\AccessControl.dll
%ProgramFiles%\gwyneth\internship.exe
%TEMP%\nsp5.tmp\SimpleFC.dll
<LS_APPDATA>\visigoths.exe
%ProgramFiles%\Logins\schoolcraft.exe
%ProgramFiles%\Logins\visigoths.exe
%WINDIR%\inhumane.exe
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RnMZQ2a0a1a71SSeFXn20RnMZQ7a[1].asp
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RnMZQ2a0a1a71SSeFXn20RnMZQ7a[1].asp
<LS_APPDATA>\Microsoft\Internet Explorer\MSIMGSIZ.DAT
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\2-RnMZQ2a0a1a71SSeFXn20RnMZQ7a[1].asp
%TEMP%\nsvB.tmp\ShellLink.dll
%TEMP%\nsmC.tmp\nsExec.dll
%TEMP%\nsmC.tmp\nsD.tmp
%TEMP%\nsh2.tmp\132315.exe
%TEMP%\nsh2.tmp\NMjohnnie.exe
%TEMP%\nsh2.tmp\Microsoft.Win32.TaskScheduler.dll
%TEMP%\nsh2.tmp\108836.exe
%TEMP%\nsh2.tmp\28936.exe
%TEMP%\nsh2.tmp\46597.exe
%TEMP%\nsh2.tmp\57078.exe
%TEMP%\nsh2.tmp\119395.exe
%ProgramFiles%\prewired\visigoths.dll
%ProgramFiles%\prewired\visigoths.exe
<LS_APPDATA>\schoolcraft.exe
%ProgramFiles%\prewired\prewired.exe
%ProgramFiles%\Biomaterial\Biomaterial.exe
%ProgramFiles%\Biomaterial\schoolcraft.dll
%ProgramFiles%\Biomaterial\schoolcraft.exe

Deletes the following files:

%TEMP%\nsvB.tmp\ShellLink.dll
%TEMP%\nsx7.tmp\AccessControl.dll
%TEMP%\nsp5.tmp\SimpleFC.dll

Network activity:

Connects to:

'wo#####ppatroness.pw':80
'localhost':1045
'localhost':1038
'localhost':1036
'localhost':1037

TCP:

HTTP GET requests:

http://www.wo#####ppatroness.pw/RnMZQ2a0a1a71SSeFXn20RnMZQ7a.asp?me########################################## via wo#####ppatroness.pw
http://www.wo#####ppatroness.pw/2-RnMZQ2a0a1a71SSeFXn20RnMZQ7a.asp?sh################################################## via wo#####ppatroness.pw

UDP:

DNS ASK ww##.###dchippatroness.pw
DNS ASK www.wo#####ppatroness.pw

Miscellaneous:

Searches for the following windows:

ClassName: 'Chrome_WidgetWin_0' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''

Creates and executes the following:

'%TEMP%\nsh2.tmp\NMjohnnie.exe' "%ProgramFiles%\premeditation\premeditation.exe" "k60243591"
'%TEMP%\nsh2.tmp\119395.exe'
'%TEMP%\nsh2.tmp\NMjohnnie.exe' "%ProgramFiles%\Logins\schoolcraft.exe" "60243591"
'%TEMP%\nsh2.tmp\NMjohnnie.exe' "%ProgramFiles%\Logins\visigoths.exe" "6024359160243591"
'%TEMP%\nsh2.tmp\108836.exe'
'%TEMP%\nsmC.tmp\nsD.tmp' taskkill /im chrome.exe
'%ProgramFiles%\gwyneth\internship.exe'
'%TEMP%\nsh2.tmp\57078.exe'
'%ProgramFiles%\Logins\visigoths.exe'
'%TEMP%\nsh2.tmp\132315.exe'
'%ProgramFiles%\Biomaterial\schoolcraft.exe'
'%TEMP%\nsh2.tmp\NMjohnnie.exe' "%ProgramFiles%\Biomaterial\schoolcraft.exe" "87611802"
'%TEMP%\nsh2.tmp\NMjohnnie.exe' "%ProgramFiles%\prewired\visigoths.exe" "8761180287611802"
'%TEMP%\nsh2.tmp\NMjohnnie.exe' "<LS_APPDATA>\visigoths.exe" "2941935629419356"
'%ProgramFiles%\Logins\schoolcraft.exe'
'%TEMP%\nsh2.tmp\46597.exe'
'%TEMP%\nsh2.tmp\NMjohnnie.exe' "<LS_APPDATA>\schoolcraft.exe" "29419356"