Trojan.DownLoader30.26301

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\WindowsRServices] 'ImagePath' = '"%APPDATA%\Adobe\windowsNetDir\WindowsRServices.exe"'
[<HKLM>\System\CurrentControlSet\Services\WindowsRServices] 'Start' = '00000002'

Modifies file system

Creates the following files

%TEMP%\aut1.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\wmiplvse.exe.config
%TEMP%\autf.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\wniprvse.pdb
%APPDATA%\adobe\windowsnetdir\aforge.video.dll
%APPDATA%\adobe\windowsnetdir\aforge.video.ffmpeg.dll
%APPDATA%\adobe\windowsnetdir\avcodec-53.dll
%APPDATA%\adobe\windowsnetdir\avformat-53.dll
%APPDATA%\adobe\windowsnetdir\avutil-51.dll
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\wmiplvse.exe
%TEMP%\aute.tmp
%APPDATA%\adobe\windowsnetdir\msconfig.ini
%APPDATA%\adobe\windowsnetdir\windowsrservices.exe.config
%APPDATA%\adobe\windowsnetdir\windowsrservices.pdb
%APPDATA%\adobe\windowsnetdir\wmiplvse.exe
%APPDATA%\adobe\windowsnetdir\wmiplvse.exe.config
%APPDATA%\adobe\windowsnetdir\wniprvse.pdb
%APPDATA%\adobe\windowsnetdir\install.bat
%APPDATA%\adobe\windowsnetdir\uninstal.bat
%APPDATA%\dd_wmiplvse\installutil.installlog
%APPDATA%\adobe\windowsnetdir\swscale-2.dll
%APPDATA%\adobe\windowsnetdir\windowsrservices.exe
%TEMP%\autd.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\windowsrservices.pdb
%TEMP%\autc.tmp
%TEMP%\aut2.tmp
%APPDATA%\dd_wmiplvse\windowscent\incon.bat
%TEMP%\aut3.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\aforge.video.dll
%TEMP%\aut4.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\aforge.video.ffmpeg.dll
%TEMP%\aut5.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\avcodec-53.dll
%TEMP%\aut6.tmp
%APPDATA%\dd_wmiplvse\windowsdefault.exe
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\avformat-53.dll
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\avutil-51.dll
%TEMP%\aut8.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\msconfig.ini
%TEMP%\aut9.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\swscale-2.dll
%TEMP%\auta.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\windowsrservices.exe
%TEMP%\autb.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\windowsrservices.exe.config
%TEMP%\aut7.tmp
%APPDATA%\adobe\windowsnetdir\windowsrservices.installlog
%APPDATA%\adobe\windowsnetdir\windowsrservices.installstate

Deletes the following files

%TEMP%\aut1.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\wmiplvse.exe
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\windowsrservices.pdb
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\windowsrservices.exe.config
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\windowsrservices.exe
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\swscale-2.dll
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\msconfig.ini
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\avutil-51.dll
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\avformat-53.dll
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\avcodec-53.dll
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\aforge.video.ffmpeg.dll
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\aforge.video.dll
%APPDATA%\dd_wmiplvse\windowscent\incon.bat
%APPDATA%\dd_wmiplvse\windowsdefault.exe
%TEMP%\autf.tmp
%TEMP%\aute.tmp
%TEMP%\autd.tmp
%TEMP%\autc.tmp
%TEMP%\autb.tmp
%TEMP%\auta.tmp
%TEMP%\aut9.tmp
%TEMP%\aut8.tmp
%TEMP%\aut7.tmp
%TEMP%\aut6.tmp
%TEMP%\aut5.tmp
%TEMP%\aut4.tmp
%TEMP%\aut3.tmp
%TEMP%\aut2.tmp
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\wmiplvse.exe.config
%APPDATA%\dd_wmiplvse\windowscent\windowsnetdir\wniprvse.pdb

Network activity

Connects to

'39.#00.7.22':3759

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Windows ?????'

Creates and executes the following

'%APPDATA%\dd_wmiplvse\windowsdefault.exe'
'%APPDATA%\adobe\windowsnetdir\wmiplvse.exe'
'%APPDATA%\adobe\windowsnetdir\windowsrservices.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c ""%APPDATA%\DD_wmiplvse\WindowsCent\inCon.bat""
'<SYSTEM32>\xcopy.exe' "%APPDATA%\DD_wmiplvse\WindowsCent\windowsNetDir" "%APPDATA%\Adobe\windowsNetDir" /e /y /i
'<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Adobe\windowsNetDir\Install.bat""
'%WINDIR%\microsoft.net\framework\v2.0.50727\installutil.exe' "%APPDATA%\Adobe\windowsNetDir\WindowsRServices.exe"
'<SYSTEM32>\sc.exe' config WindowsRServices start= auto
'<SYSTEM32>\net.exe' Start WindowsRServices
'<SYSTEM32>\net1.exe' Start WindowsRServices
'<SYSTEM32>\sc.exe' failure WindowsRServices reset= 0 actions= restart/60000
'<SYSTEM32>\sc.exe' description WindowsRServices Windows Serivce
'<SYSTEM32>\wbem\wmiapsrv.exe'