Trojan.DownLoader40.50886

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{050d4fc8-5d48-4b8f-8972-47c82c46020f}' = '"%ALLUSERSPROFILE%\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredi...
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{2af972c7-13b0-4978-92a8-fee26a4fb4e9}' = '"%ALLUSERSPROFILE%\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredi...
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{51adbf11-493f-431c-a862-967a0fae2944}' = '"%ALLUSERSPROFILE%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\vcredi...
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{ce085a78-074e-4823-8dc1-8a721b94b76d}' = '"%ALLUSERSPROFILE%\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredi...

Modifies file system

Creates the following files

%APPDATA%\max value software\holdem manager\kits\vsredist2013_x64.exe
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\license.rtf
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\logo.png
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.wxl
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.xml
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\wixstdba.dll
%TEMP%\dd_vcredist_amd64_20210730195517.log
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\license.rtf
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\logo.png
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\thm.wxl
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\thm.xml
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\wixstdba.dll
%TEMP%\dd_vcredist_x86_20210730195509.log
%TEMP%\dd_vcredist_x86_20210730195525.log
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\logo.png
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\thm.wxl
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\thm.xml
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\wixstdba.dll
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.be\vcredist_x64.exe
%TEMP%\dd_vcredist_amd64_20210730195501.log
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\logo.png
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\thm.wxl
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\thm.xml
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\license.rtf
%APPDATA%\max value software\holdem manager\kits\vsredist2013_x64.exe.full

Deletes the following files

%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\thm.xml
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\thm.wxl
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\logo.png
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\wixstdba.dll
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.xml
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\thm.wxl
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\logo.png
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\license.rtf
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll
%TEMP%\{ce085a78-074e-4823-8dc1-8a721b94b76d}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\thm.xml
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\thm.wxl
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\logo.png
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\license.rtf
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\bootstrapperapplicationdata.xml
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\wixstdba.dll
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\thm.xml
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\thm.wxl
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\logo.png
%TEMP%\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\.ba1\license.rtf
%TEMP%\{51adbf11-493f-431c-a862-967a0fae2944}\.ba1\wixstdba.dll
%TEMP%\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.be\vcredist_x64.exe

Modifies the following files

%ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\state.rsm
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\state.rsm
%ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm

Network activity

Connects to

'ed#####.holdemmanager.com':443
'x.##2.us':80
'microsoft.com':80

TCP

Other

'ed#####.holdemmanager.com':443

UDP

DNS ASK ed#####.holdemmanager.com
DNS ASK x.##2.us
DNS ASK microsoft.com

Miscellaneous

Creates and executes the following

'%APPDATA%\max value software\holdem manager\kits\vsredist2013_x64.exe' /q
'%APPDATA%\max value software\holdem manager\kits\vsredist2013_x64.exe' /q -burn.unelevated BurnPipe.{B58BB281-1FE5-49A8-97D8-90CB07BFCF4D} {4CAE59E6-5563-4262-B082-97516A6BC1A7} 996