Trojan.DownLoader46.30936

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\iexplorei
<SYSTEM32>\tasks\audiodga
<SYSTEM32>\tasks\audiodg
<SYSTEM32>\tasks\iexplore
<SYSTEM32>\tasks\dwmd
<SYSTEM32>\tasks\firefoxf
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\dwm
<SYSTEM32>\tasks\servicess
<SYSTEM32>\tasks\services

Modifies file system

Creates the following files

C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\iexplore.exe
C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\9db6e019d4f04e
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\audiodg.exe
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\42af1c969fbb7b
<Current directory>\dwm.exe
<Current directory>\6cb0b6c459d5d3
%ProgramFiles%\microsoft sql server compact edition\v3.5\desktop\firefox.exe
%ProgramFiles%\microsoft sql server compact edition\v3.5\desktop\0fc223bdacedc3
%ProgramFiles%\dvd maker\shared\firefox.exe
%ProgramFiles%\dvd maker\shared\0fc223bdacedc3
%WINDIR%\web\wallpaper\nature\services.exe
%WINDIR%\web\wallpaper\nature\c5b4cb5e9653cc

Network activity

Connects to

'87#####m.n9shteam1.top':80

TCP

HTTP GET requests

http://87#####m.n9shteam1.top/nyashsupport.php?s8################################################################################################################################################...

UDP

DNS ASK 87#####m.n9shteam1.top

Miscellaneous

Creates and executes the following

'<Current directory>\dwm.exe'
'<Current directory>\dwm.exe' ' (with hidden window)

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 8 /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 10 /tr "'%WINDIR%\Web\Wallpaper\Nature\services.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\DVD Maker\Shared\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles%\DVD Maker\Shared\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\DVD Maker\Shared\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\Microsoft SQL Server Compact Edition\v3.5\Desktop\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ProgramFiles%\Microsoft SQL Server Compact Edition\v3.5\Desktop\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\Microsoft SQL Server Compact Edition\v3.5\Desktop\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'<Current directory>\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<Current directory>\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'<Current directory>\dwm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\audiodg.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 7 /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'%WINDIR%\Web\Wallpaper\Nature\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 5 /tr "'%WINDIR%\Web\Wallpaper\Nature\services.exe'" /rl HIGHEST /f