Trojan.DownLoader41.56955

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Microsoft\WPD\services.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"%ALLUSERSPROFILE%\Microsoft\WPD\services.exe"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'services' = '"%ALLUSERSPROFILE%\Microsoft\WPD\services.exe"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Microsoft\WPD\services.exe", "<SYSTEM32>\devrtl\sppsvc.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"<SYSTEM32>\devrtl\sppsvc.exe"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"<SYSTEM32>\devrtl\sppsvc.exe"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Microsoft\WPD\services.exe", "<SYSTEM32>\devrtl\sppsvc.exe", "<SYSTEM32>\m...
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"<SYSTEM32>\mfAACEnc\taskhost.exe"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'taskhost' = '"<SYSTEM32>\mfAACEnc\taskhost.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\WUDFHost.exe"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\WUDFHost.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"<SYSTEM32>\evr\services.exe"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'services' = '"<SYSTEM32>\evr\services.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\services
<SYSTEM32>\tasks\sppsvc
<SYSTEM32>\tasks\taskhost
<SYSTEM32>\tasks\wudfhost

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\microsoft\wpd\services.exe
%ALLUSERSPROFILE%\microsoft\wpd\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d
%WINDIR%\syswow64\devrtl\sppsvc.exe
%WINDIR%\syswow64\devrtl\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c
%WINDIR%\syswow64\mfaacenc\taskhost.exe
%WINDIR%\syswow64\mfaacenc\b75386f1303e64d8139363b71e44ac16341adf4e
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\wudfhost.exe
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\480b7989c529f6ff17bde430d81d4770fb5337f5
%WINDIR%\syswow64\evr\services.exe
%WINDIR%\syswow64\evr\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d

Network activity

Connects to

'78.##.221.196':80
'ip##pi.com':80

TCP

HTTP GET requests

http://78.##.221.196/phpMathmobilecore/phpServer/rulerule/CpuWar/recordmobileDjango/antirecordgeneratorhtop/messageanti/PrefhtopServerDjango/searcherdata/bootprogram/Linuxflower.php?8T#########...
http://ip##pi.com/line/?fi############

UDP

DNS ASK ip##pi.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\devrtl\sppsvc.exe'
'%WINDIR%\syswow64\devrtl\sppsvc.exe' ' (with hidden window)

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Microsoft\WPD\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "sppsvc" /sc ONLOGON /tr "'<SYSTEM32>\devrtl\sppsvc.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'<SYSTEM32>\mfAACEnc\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'<SYSTEM32>\evr\services.exe'" /rl HIGHEST /f