Trojan.DownLoader34.57915

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\UVNC_Service] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\UVNC_Service] 'ImagePath' = '"%ProgramFiles(x86)%\Eickmann Computer\Fernwartung\winvnc.exe" -service'

Creates the following services

'UVNC_Service' "%ProgramFiles(x86)%\Eickmann Computer\Fernwartung\winvnc.exe" -service

Modifies file system

Creates the following files

%ProgramFiles(x86)%\eickmann computer\fernwartung\ultravnc.ini
%ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung herr auer.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung herr eickmann.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung lami.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung port 80.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung secure port.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung whm.lnk
%HOMEPATH%\desktop\fernwartung eickmann computer.lnk
%TEMP%\eickmann computer fernwartungs install service log.txt
%ProgramFiles(x86)%\eickmann computer\fernwartung\vnchooks.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung ahm.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung ehnb.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung frau bristow.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung frau wiesner.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung herr auer.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung herr eickmann.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung lami.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung port 80.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung secure port.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung frau bristow.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung frau wiesner.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung ehnb.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung ehm.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\startmenu\verbindung ahm.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\uvnc_settings.exe
%ProgramFiles(x86)%\eickmann computer\fernwartung\vncscai.exe
%ProgramFiles(x86)%\eickmann computer\fernwartung\winvnc.exe
%ProgramFiles(x86)%\eickmann computer\fernwartung\authadmin.dll
%ProgramFiles(x86)%\eickmann computer\fernwartung\authssp.dll
%ProgramFiles(x86)%\eickmann computer\fernwartung\ldapauth.dll
%ProgramFiles(x86)%\eickmann computer\fernwartung\logging.dll
%ProgramFiles(x86)%\eickmann computer\fernwartung\logmessages.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung whm.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\verbindung ehm.lnk
%ProgramFiles(x86)%\eickmann computer\fernwartung\unzip32.dll
%ProgramFiles(x86)%\eickmann computer\fernwartung\zip32.dll
%ProgramFiles(x86)%\eickmann computer\fernwartung\logo.gif
%ProgramFiles(x86)%\eickmann computer\fernwartung\vncscai.exe.manifest
%ProgramFiles(x86)%\eickmann computer\fernwartung\cad.exe.manifest
%ProgramFiles(x86)%\eickmann computer\fernwartung\winvnc.exe.manifest
%ProgramFiles(x86)%\eickmann computer\fernwartung\eickmaus.ico
%ProgramFiles(x86)%\eickmann computer\fernwartung\vncscai_installservice_wennadmin.exe
%ProgramFiles(x86)%\eickmann computer\fernwartung\vncscaism.exe
%ProgramFiles(x86)%\eickmann computer\fernwartung\cad.exe
%ProgramFiles(x86)%\eickmann computer\fernwartung\workgrpdomnt4.dll
%TEMP%\eickmann computer fernwartungs log.txt

Network activity

Connects to

'localhost':5900

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%ProgramFiles(x86)%\eickmann computer\fernwartung\vncscai_installservice_wennadmin.exe'
'%ProgramFiles(x86)%\eickmann computer\fernwartung\winvnc.exe' -service
'%ProgramFiles(x86)%\eickmann computer\fernwartung\winvnc.exe' -service_run
'%ProgramFiles(x86)%\eickmann computer\fernwartung\vncscaism.exe'
'%ProgramFiles(x86)%\eickmann computer\fernwartung\vncscai.exe'
'%WINDIR%\syswow64\sc.exe' CREATE "UVNC_Service" BINPATH= "\"%ProgramFiles(x86)%\Eickmann Computer\Fernwartung\winvnc.exe\" -service" start= auto' (with hidden window)
'%WINDIR%\syswow64\sc.exe' DELETE "UVNC_EICKMANN_TEMP"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\sc.exe' CREATE "UVNC_Service" BINPATH= "\"%ProgramFiles(x86)%\Eickmann Computer\Fernwartung\winvnc.exe\" -service" start= auto
'%WINDIR%\syswow64\sc.exe' DELETE "UVNC_EICKMANN_TEMP"