Trojan.DownLoader34.37915

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\Direct WAV MP3 Splitter\shell\open\command] '' = '"%ProgramFiles(x86)%\Direct WAV MP3 Splitter\Splitter.exe" "%1"'

Modifies file system

Creates the following files

%TEMP%\is-do6je.tmp\<File name>.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\direct wav mp3 splitter\direct wav mp3 splitter.lnk
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-h75hk.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-sv22o.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-vj6rk.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-secdr.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-vos7b.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-40u59.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-jp6ua.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-sqbav.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-fhp7b.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\images\is-nj3d3.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-l62of.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-0i0g0.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-uajov.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-o2r8d.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-h5qjb.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\is-v7n56.tmp
%TEMP%\is-svvnd.tmp\_isetup\_iscrypt.dll
%TEMP%\is-svvnd.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\direct wav mp3 splitter\splitter.url
%ProgramFiles(x86)%\direct wav mp3 splitter\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\direct wav mp3 splitter\is-v7n56.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\unins000.exe
from %ProgramFiles(x86)%\direct wav mp3 splitter\is-h5qjb.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\splitter.exe
from %ProgramFiles(x86)%\direct wav mp3 splitter\is-o2r8d.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\readme.txt
from %ProgramFiles(x86)%\direct wav mp3 splitter\is-uajov.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\splithelp.chm
from %ProgramFiles(x86)%\direct wav mp3 splitter\is-0i0g0.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\bass.dll
from %ProgramFiles(x86)%\direct wav mp3 splitter\is-l62of.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\bass_fx.dll
from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-nj3d3.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\button_big_buy_the_full_version_now-trans.png
from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-fhp7b.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\buy.gif
from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-sqbav.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\buynow_sm.gif
from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-jp6ua.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\buy_full_version.gif
from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-40u59.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\cancel_sm.gif
from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-vos7b.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\continue_free_trial.gif
from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-secdr.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\customersvc_sm.gif
from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-vj6rk.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\register_sm.gif
from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-sv22o.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\reissuekey_sm.gif
from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-h75hk.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\security_lock_text.gif

Network activity

Connects to

'sy###ee.info':80

TCP

HTTP POST requests

http://sy###ee.info/v2/events

UDP

DNS ASK sy###ee.info

Miscellaneous

Creates and executes the following

'%TEMP%\is-do6je.tmp\<File name>.tmp' /SL5="$120228,9716927,358400,<Full path to file>"
'%ProgramFiles(x86)%\direct wav mp3 splitter\splitter.exe' <File name>.exe