Trojan.DownLoader2.7133

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\SYSTEM\CurrentControlSet\Services\userinit] 'Start' = '00000002'
[<HKLM>\SYSTEM\CurrentControlSet\Services\userinit] 'ImagePath' = '\\.\globalroot<SYSTEM32>\usеrinit.exe'

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Security Center

blocks the following features:

Windows Security Center

Injects code into

the following system processes:

globalroot<SYSTEM32>\usеrinit.exe

Modifies file system

Creates the following files

<SYSTEM32>\exefile.exe
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\w7_tab[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\w7_sts_bg[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\w7_sts_inn[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\w7_bar_set[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\w7_grad[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\w7_th[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\w7_st_shadow[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\w7_st_bg[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\w7_headbot[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\w7_st[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\w7_menu[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\w7_getlicense[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\w7_ulp[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\w7_pbar_bg[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\w7_pbar[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\w7_tab_act[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\w7_smi[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\w7_head[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\script_card[1]
<SYSTEM32>\usеrinit.exe
<SYSTEM32>\msiavjyv.dll
%TEMP%\{e9c1e0ac-c9b1-4c85-94de-9c1518918d02}.tlb
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\install[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\w5_installer[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\w5_ajax[1]
%TEMP%\{e9c1e0ac-c9b1-4c85-94de-9c1518918d01}.tlb
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\default[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\default_win7[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\configure[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\w7_css[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0o42hqll\jquery-1.4.1.min[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\jquery.json-2.2.min[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\jh3iwefd\l10n_main[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\59o0eoqa\script_common[1]
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\t5levnel\w7_left_bg[1]
%ALLUSERSPROFILE%\.wtav