Trojan.DownLoader26.26009

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\Driver Easy Scheduled Scan.job

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe' = '%ProgramFiles%\E...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe' = '%ProgramFiles%\Eas...

Executes the following:

'<SYSTEM32>\netsh.exe' firewall add allowedprogram program="%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe" name="Driver Easy" mode=ENABLE profile=ALL

Terminates or attempts to terminate

the following user processes:

iexplore.exe

Modifies file system:

Creates the following files:

%ProgramFiles%\Easeware\DriverEasy\7z\is-C027C.tmp
%ProgramFiles%\Easeware\DriverEasy\7z\is-RB6KQ.tmp
%ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-HUF08.tmp
%ProgramFiles%\Easeware\DriverEasy\is-1N4A4.tmp
%ProgramFiles%\Easeware\DriverEasy\is-URHFJ.tmp
%ProgramFiles%\Easeware\DriverEasy\is-OOJ6U.tmp
%ProgramFiles%\Easeware\DriverEasy\is-PUF7U.tmp
%ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-IOS2M.tmp
%ProgramFiles%\Easeware\DriverEasy\unins000.msg
%ProgramFiles%\Easeware\DriverEasy\unins000.dat
%APPDATA%\Easeware\DriverEasy\settings.dat
%ALLUSERSPROFILE%\Desktop\Driver Easy.lnk
%TEMP%\is-QE7BR.tmp\is-6GLT5.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Driver Easy\Driver Easy.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Driver Easy\Uninstall Driver Easy.lnk
%ProgramFiles%\Easeware\DriverEasy\is-GVRQP.tmp
%TEMP%\is-E4HVU.tmp\~ftwwrle.tmp
%TEMP%\is-QE7BR.tmp\_isetup\_shfoldr.dll
%TEMP%\is-QE7BR.tmp\isxdl.dll
%TEMP%\~ftwwrle.tmp
%TEMP%\aut1.tmp
%TEMP%\wjnjrkp
%TEMP%\aut2.tmp
%ProgramFiles%\Easeware\DriverEasy\is-AOD0M.tmp
%ProgramFiles%\Easeware\DriverEasy\is-C90G3.tmp
%ProgramFiles%\Easeware\DriverEasy\is-N8N2D.tmp
%ProgramFiles%\Easeware\DriverEasy\is-T7UE9.tmp
%ProgramFiles%\Easeware\DriverEasy\is-TB6PS.tmp
%ProgramFiles%\Easeware\DriverEasy\is-T5U73.tmp
%ProgramFiles%\Easeware\DriverEasy\is-KL4UF.tmp
%ProgramFiles%\Easeware\DriverEasy\is-EQ27G.tmp

Sets the 'hidden' attribute to the following files:

%TEMP%\~ftwwrle.tmp

Deletes the following files:

%TEMP%\is-QE7BR.tmp\isxdl.dll
%TEMP%\is-QE7BR.tmp\InstallDotNet.bat
%TEMP%\is-E4HVU.tmp\~ftwwrle.tmp
%TEMP%\is-QE7BR.tmp\_isetup\_shfoldr.dll
%TEMP%\wjnjrkp
%TEMP%\aut1.tmp
<SYSTEM32>\d3d9caps.dat
%TEMP%\aut2.tmp

Moves the following files:

from %ProgramFiles%\Easeware\DriverEasy\is-PUF7U.tmp to %ProgramFiles%\Easeware\DriverEasy\Map.xml
from %ProgramFiles%\Easeware\DriverEasy\is-1N4A4.tmp to %ProgramFiles%\Easeware\DriverEasy\SevenZipSharp.dll
from %ProgramFiles%\Easeware\DriverEasy\is-URHFJ.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.Driver.Core.dll
from %ProgramFiles%\Easeware\DriverEasy\is-OOJ6U.tmp to %ProgramFiles%\Easeware\DriverEasy\Interop.WUApiLib.dll
from %ProgramFiles%\Easeware\DriverEasy\7z\is-C027C.tmp to %ProgramFiles%\Easeware\DriverEasy\7z\7z.dll
from %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-IOS2M.tmp to %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\HardwareInfo64.dll
from %TEMP%\is-QE7BR.tmp\is-6GLT5.tmp to %TEMP%\is-QE7BR.tmp\InstallDotNet.bat
from %ProgramFiles%\Easeware\DriverEasy\7z\is-RB6KQ.tmp to %ProgramFiles%\Easeware\DriverEasy\7z\7z86.dll
from %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-HUF08.tmp to %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\HardwareInfo.dll
from %ProgramFiles%\Easeware\DriverEasy\is-KL4UF.tmp to %ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe
from %ProgramFiles%\Easeware\DriverEasy\is-EQ27G.tmp to %ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe.config
from %ProgramFiles%\Easeware\DriverEasy\is-AOD0M.tmp to %ProgramFiles%\Easeware\DriverEasy\unins000.exe
from %ProgramFiles%\Easeware\DriverEasy\is-T5U73.tmp to %ProgramFiles%\Easeware\DriverEasy\7zip_license.txt
from %ProgramFiles%\Easeware\DriverEasy\is-TB6PS.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe
from %ProgramFiles%\Easeware\DriverEasy\is-T7UE9.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe.config
from %ProgramFiles%\Easeware\DriverEasy\is-GVRQP.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.Driver.Backup.dll
from %ProgramFiles%\Easeware\DriverEasy\is-C90G3.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe.config
from %ProgramFiles%\Easeware\DriverEasy\is-N8N2D.tmp to %ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe

Substitutes the following files:

<SYSTEM32>\d3d9caps.dat

Network activity:

Connects to:

'go#####analytics.com':443
'wp#d':80

TCP:

HTTP GET requests:

http://11#.#11.111.1/wpad.dat via wp#d

UDP:

DNS ASK www.go#####analytics.com
DNS ASK wp#d

Miscellaneous:

Creates and executes the following:

'%ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe' DriverEasy en
'%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe'
'%ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe' -create "Driver Easy Scheduled Scan" "%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe"
'%TEMP%\~ftwwrle.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-E4HVU.tmp\~ftwwrle.tmp' /SL5="$100E4,3443869,395264,%TEMP%\~ftwwrle.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-