Trojan.DownLoader36.38861

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'fffedbafeb' = 'cmd.exe /c explorer.exe "%WINDIR%\Microsoft.NET\Framework\daebdaddfc.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'ddbddafdff' = 'cmd.exe /c explorer.exe "%WINDIR%\Resources\Themes\bfdcbeadfa.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'acccdbcbbd' = 'cmd.exe /c explorer.exe "%WINDIR%\Resources\Themes\aero\Shell\bcbefaebed.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'dccfbffbaf' = 'cmd.exe /c explorer.exe "%WINDIR%\Cursors\eebdefddef.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'eecdffcfcc' = 'cmd.exe /c explorer.exe "C:\Users\Public\Documents\cebefffdef.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'ddebabfcaa' = 'cmd.exe /c explorer.exe "%CommonProgramFiles%\System\aaabadddeb.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'bfefacbddd' = 'cmd.exe /c explorer.exe "%WINDIR%\Web\Wallpaper\Windows\dbfceabaaf.exe"'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Microsoft.NET\Framework\daebdaddfc.exe' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Resources\Themes\bfdcbeadfa.exe' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Resources\Themes\aero\Shell\bcbefaebed.exe' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Cursors\eebdefddef.exe' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] 'C:\Users\Public\Documents\cebefffdef.exe' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%CommonProgramFiles%\System\aaabadddeb.exe' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Web\Wallpaper\Windows\dbfceabaaf.exe' = '00000000'

Modifies file system

Creates the following files

Network activity

Connects to

TCP

HTTP GET requests

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Microsoft.NET\Framework\daebdaddfc.exe" -Force' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\bfdcbeadfa.exe" -Force' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\aero\Shell\bcbefaebed.exe" -Force' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Cursors\eebdefddef.exe" -Force' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\cebefffdef.exe" -Force' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%CommonProgramFiles%\System\aaabadddeb.exe" -Force' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Web\Wallpaper\Windows\dbfceabaaf.exe" -Force' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c timeout 1' (with hidden window)

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Microsoft.NET\Framework\daebdaddfc.exe" -Force
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\bfdcbeadfa.exe" -Force
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Resources\Themes\aero\Shell\bcbefaebed.exe" -Force
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Cursors\eebdefddef.exe" -Force
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\cebefffdef.exe" -Force
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%CommonProgramFiles%\System\aaabadddeb.exe" -Force
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Web\Wallpaper\Windows\dbfceabaaf.exe" -Force
'%WINDIR%\syswow64\cmd.exe' /c timeout 1
'%WINDIR%\syswow64\timeout.exe' 1