Trojan.DownLoader40.48399

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\wmiprvse
<SYSTEM32>\tasks\audiodg
<SYSTEM32>\tasks\dwm
<SYSTEM32>\tasks\iexplore
<SYSTEM32>\tasks\smss
<SYSTEM32>\tasks\lsass
<SYSTEM32>\tasks\wudfhost
<SYSTEM32>\tasks\lsm
<SYSTEM32>\tasks\mdm

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

Modifies file system

Creates the following files

C:\far2\fexcept\wmiprvse.exe
%WINDIR%\syswow64\nlsdata002a\101b941d020240259ca4912829b53995ad543df6
%WINDIR%\syswow64\nlsdata002a\lsm.exe
%WINDIR%\syswow64\proquota\480b7989c529f6ff17bde430d81d4770fb5337f5
%WINDIR%\syswow64\proquota\wudfhost.exe
C:\documents and settings\9db6e019d4f04ef534d0f91b3462d805c40e9d20
C:\documents and settings\iexplore.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsass.exe
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\24dbde2999530ef5fd907494bc374d663924116c
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wmiprvse.exe
%WINDIR%\addins\69ddcba757bf72f7d36c464c71f42baab150b2b9
%WINDIR%\addins\smss.exe
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\9db6e019d4f04ef534d0f91b3462d805c40e9d20
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\iexplore.exe
%WINDIR%\syswow64\occache\6cb0b6c459d5d3455a3da700e713f2e2529862ff
%WINDIR%\syswow64\occache\dwm.exe
%WINDIR%\syswow64\mfc110enu\6cb0b6c459d5d3455a3da700e713f2e2529862ff
%WINDIR%\syswow64\mfc110enu\dwm.exe
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
%ProgramFiles(x86)%\microsoft analysis services\as oledb\10\cartridges\audiodg.exe
C:\far2\fexcept\24dbde2999530ef5fd907494bc374d663924116c
%CommonProgramFiles(x86)%\microsoft shared\vs7debug\coloader\mdm.exe
%CommonProgramFiles(x86)%\microsoft shared\vs7debug\coloader\559fba5f8e44108851927af432f0edac6117c574

Network activity

Connects to

'14#.#54.66.50':80

Miscellaneous

Creates and executes the following

'%WINDIR%\addins\smss.exe'
'<Full path to file>' ' (with hidden window)
'%WINDIR%\addins\smss.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Far2\FExcept\WmiPrvSE.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Analysis Services\AS OLEDB\10\Cartridges\audiodg.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<SYSTEM32>\mfc110enu\dwm.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<SYSTEM32>\occache\dwm.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\iexplore.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%WINDIR%\addins\smss.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\lsass.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Documents and Settings\iexplore.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<SYSTEM32>\proquota\WUDFHost.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'<SYSTEM32>\NlsData002a\lsm.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\coloader\mdm.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose