Trojan.DownLoader27.14433

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Clients\StartMenuInternet\ieprogid.exe\Shell\open\command] '' = ''
[<HKLM>\SOFTWARE\Classes\ieprogid\Shell\open\command] '' = '"" "%1"'
[<HKLM>\SOFTWARE\Classes\HTTP\shell\open\command] '' = '"" "%1"'
[<HKLM>\SOFTWARE\Classes\https\shell\open\command] '' = '"" "%1"'
[<HKLM>\SOFTWARE\Classes\htmlfile\shell\open\command] '' = '"" "%1"'
[<HKLM>\SOFTWARE\Classes\mhtmlfile\shell\open\command] '' = '"" "%1"'

Modifies file system:

Creates the following files:

<SYSTEM32>\tebixaweydwv.dll
%TEMP%\{AE7D8BB7-2CA9-4B20-B7E2-58FC26A804CE}
%TEMP%\{CABA147B-AA60-4884-B2D5-5A1924D8125E}
%TEMP%\{A0F1AB54-3835-4D71-9F5F-DBEAE9F3416D}
%TEMP%\{0E219070-731F-4857-A6D9-F07B31F98DC6}
%TEMP%\{980FE827-C04F-46F2-BCD8-23181096AEE7}
%TEMP%\{7315BEF7-00A7-497E-8A54-FBFEF4FD3254}
%TEMP%\{9AAF563C-E26F-4217-9AFD-02CECB803A38}
%TEMP%\{10A25C2A-ADBD-4D2D-BDC6-087C4AD2D1B2}
%TEMP%\{ABEFBDD6-6BE8-43ED-BAB5-0C3C8CDCE6AC}
%TEMP%\{680F6612-ED67-473D-9D2C-ABA5ACE68732}
%TEMP%\{D9F66254-4079-4660-97DA-41E48C5B25C0}
%TEMP%\{8E3C8942-CE97-425E-8328-50B255E79324}
%TEMP%\{A3828B88-FC13-4BDD-9D42-706ED574350C}
%TEMP%\{DA5FF110-B25B-4E34-BC50-E074C563FD59}
%TEMP%\{5AB3F7CC-FBDD-413B-92BB-8793EBD64951}
%TEMP%\{3AD2A63A-0BAC-4892-8E40-6CEFC005AF9D}
%TEMP%\{01A2F195-37BC-42FC-BD90-B368540BAB6E}
%TEMP%\{6CBE15A0-1B12-479A-91E9-F358CB80FAA7}
%TEMP%\{DB66CB9C-DBDA-4E03-AD4D-00897C13A4C4}
%TEMP%\{42EB5C70-D467-4067-BC5C-8547BCD44725}
%TEMP%\{817D43C9-607E-4281-AD10-5C857E2CD720}
%TEMP%\{75AF79A5-E279-4332-81FD-B9674CBEE7B9}
%TEMP%\{56D5E410-AE05-436B-9EC7-8D9E9359C554}
%TEMP%\{D255365C-82D9-4627-9B8D-E4F5F4B41581}
%TEMP%\{73D1C231-6573-4A83-BE8F-A27BEB10AD9A}
%TEMP%\{D2A84E6E-AB23-43F1-AC2A-B00275851CE1}
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Microsoft\Protect\CREDHIST
%TEMP%\{0ADE623C-966A-460E-8AD2-36D22E3D6D01}
%TEMP%\{7E38A73C-F97A-4E8E-85C9-0A368240248A}

Network activity:

Connects to:

TCP:

HTTP GET requests:

http://vs#.##static.com/pc_static/icons/big-play-btn.png
http://vs#.##static.com/static/image/timeout.png
http://s0.###123img.com/res/r/image/2014-01-25/e05197cd3f4b34ca8404e4d8ee9086ff.png
http://s0.###123img.com/res/r/image/2014-01-22/174e9681f87ae1e6722b420cb42d45a8.jpg
http://bs####.hao123.com/game/767038483/9104c4ae90c4b728bcd8e8d6b581e24a.jpg
http://wa###.baidu.com/zhongxinye/16x16/730.png via 12#.#25.114.144
http://im##.hao123.com/urlicon/1821.png
http://im#.#aidu.com/img/image/loading_detail.gif via 12#.#25.114.144
http://bs####.hao123.com/gm/static/220002603/84d0f6cb6b058815b07287754a253a5f.jpg
http://f.#####tos.baidu.com/video/pic/item/95eef01f3a292df570e89d30bf315c6034a873ef.jpg via 12#.#25.114.144
http://bs####.hao123.com/public/home/1046075863/e94a30869049163a1188f2be536bf6c6.jpg
http://li##.##deo.baidu.com/aries_detail/s-play-btn.png via 12#.#25.114.144
http://bs####.hao123.com/dy/public/3870996041/2e54a45c9c32d6e30986b5460d2d74e5.jpg
http://bs####.hao123.com/gm/940842958/5d4fd3615619608756aaaa03d78e3030.jpg
http://bs####.hao123.com/static/gm/2281494841/55ebe587d8f66568cb5f3135b522ae7b.jpg
http://www.51##i.cn/pass/soip/4186446768/77af44e25b37372bcfe587407e4d0f0d.jpg via 51##i.cn