Trojan.DownLoader33.32700

Technical Information

Modifies file system

Creates the following files

<Current directory>\data\xsandbox.bin.__tmp__
<Current directory>\data\local\stubexe\0xdccd6582eda0a6f3\wisptis.exe.manifest.__tmp__
<Current directory>\data\local\stubexe\0xdccd6582eda0a6f3\wisptis.exe.__tmp__
%APPDATA%\youtubebyclick\configuration.dat
<Current directory>\data\local\meta\@programfilesx86@\youtube by click\gui.dll.__meta__.__tmp__
<Current directory>\data\local\temp\@programfilesx86@\youtube by click\gui.dll
<Current directory>\data\local\stubexe\0xd17b96659fdeb4b4\youtubebyclick.exe.manifest.__tmp__
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
<Current directory>\data\local\stubexe\0xd17b96659fdeb4b4\youtubebyclick.exe.__tmp__
%TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\x86_patch@2.0.0.0\patch.manifest.__tmp__
%TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\manifests\youtubebyclick.exe_0x7c404e1c875f371033446c2bf1c9dbfc.1.manifest.__tmp__
%TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\manifests\updater.exe_0x500435036190875618dadf8dbcf9747a.1.manifest.__tmp__
%TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\manifests\patch.exe_0x3e1d660076247804014abcf07668e9ed.1.manifest.__tmp__
%TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\_myapplication.app@1.0.0.0\myapplication.app.manifest.__tmp__
%TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\_myapplication.app@1.0.0.0\_myapplication.app@1.0.0.0.manifest.__tmp__
%TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\x86_patch@2.0.0.0\x86_patch@2.0.0.0.manifest.__tmp__
%WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357

Moves the following files

from <Current directory>\data\xsandbox.bin.__tmp__ to <Current directory>\data\xsandbox.bin
from %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\_myapplication.app@1.0.0.0\_myapplication.app@1.0.0.0.manifest.__tmp__ to %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\_myapplication.app@1.0.0.0\_myapplication.app@1.0.0.0.manifest
from %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\_myapplication.app@1.0.0.0\myapplication.app.manifest.__tmp__ to %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\_myapplication.app@1.0.0.0\myapplication.app.manifest
from %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\manifests\patch.exe_0x3e1d660076247804014abcf07668e9ed.1.manifest.__tmp__ to %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\manifests\patch.exe_0x3e1d660076247804014abcf07668e9ed.1.manifest
from %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\manifests\updater.exe_0x500435036190875618dadf8dbcf9747a.1.manifest.__tmp__ to %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\manifests\updater.exe_0x500435036190875618dadf8dbcf9747a.1.manifest
from %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\manifests\youtubebyclick.exe_0x7c404e1c875f371033446c2bf1c9dbfc.1.manifest.__tmp__ to %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\manifests\youtubebyclick.exe_0x7c404e1c875f371033446c2bf1c9dbfc.1.manifest
from %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\x86_patch@2.0.0.0\patch.manifest.__tmp__ to %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\x86_patch@2.0.0.0\patch.manifest
from %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\x86_patch@2.0.0.0\x86_patch@2.0.0.0.manifest.__tmp__ to %TEMP%\spoon\cache\0x9b04bb9e4af975e7\sxs\x86_patch@2.0.0.0\x86_patch@2.0.0.0.manifest
from <Current directory>\data\local\stubexe\0xd17b96659fdeb4b4\youtubebyclick.exe.__tmp__ to <Current directory>\data\local\stubexe\0xd17b96659fdeb4b4\youtubebyclick.exe
from <Current directory>\data\local\stubexe\0xd17b96659fdeb4b4\youtubebyclick.exe.manifest.__tmp__ to <Current directory>\data\local\stubexe\0xd17b96659fdeb4b4\youtubebyclick.exe.manifest
from <Current directory>\data\local\temp\@programfilesx86@\youtube by click\gui.dll to <Current directory>\data\local\modified\@programfilesx86@\youtube by click\gui.dll
from <Current directory>\data\local\meta\@programfilesx86@\youtube by click\gui.dll.__meta__.__tmp__ to <Current directory>\data\local\meta\@programfilesx86@\youtube by click\gui.dll.__meta__
from <Current directory>\data\local\stubexe\0xdccd6582eda0a6f3\wisptis.exe.__tmp__ to <Current directory>\data\local\stubexe\0xdccd6582eda0a6f3\wisptis.exe
from <Current directory>\data\local\stubexe\0xdccd6582eda0a6f3\wisptis.exe.manifest.__tmp__ to <Current directory>\data\local\stubexe\0xdccd6582eda0a6f3\wisptis.exe.manifest

Network activity

TCP

HTTP GET requests

http://im#.#outube.com/vi/7Sv_Bv1H7BQ/1.jpg
http://www.yo####ebyclick.com/Welcome.php?so#########
http://lo###.##utubebyclick.com/config.php?Co#############################################################################################
http://im#.#outube.com/vi/cwZb2mqId0A/1.jpg
http://im#.#outube.com/vi/SUXWAEX2jlg/1.jpg
http://im#.#outube.com/vi/DQLIyJbivxk/1.jpg
http://im#.#outube.com/vi/FU9CZEOdvio/1.jpg
http://im#.#outube.com/vi/mTzMRbmgP98/1.jpg
http://im#.#outube.com/vi/4ViLiXA0E70/1.jpg
http://im#.#outube.com/vi/uO1HNUoDzxQ/1.jpg
http://im#.#outube.com/vi/dwXFsrp6WBs/1.jpg
http://im#.#outube.com/vi/C-y70ZOSzE0/1.jpg

'yo####ebyclick.com':443

UDP

DNS ASK im#.#outube.com
DNS ASK yo####ebyclick.com
DNS ASK lo###.##utubebyclick.com

Miscellaneous

Searches for the following windows

ClassName: 'DDEMLMom' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'Static' WindowName: ''

Creates and executes the following

'<Current directory>\data\local\stubexe\0xd17b96659fdeb4b4\youtubebyclick.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
'<Current directory>\data\local\stubexe\0xdccd6582eda0a6f3\wisptis.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
'<Current directory>\data\local\stubexe\0xdccd6582eda0a6f3\wisptis.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8' (with hidden window)