Trojan.DownLoader25.57123

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SkypeC0SvcService.exe' = '<SYSTEM32>\regsvr32.exe /s scrrun.dll "%APPDATA%\NTLocalData\msimg32.dll" htvrh666 "%APPDATA%\NTLocalData\Skype...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\Windows Update Manager.lnk
%HOMEPATH%\Start Menu\Programs\Startup\Windows Update Manager.lnk

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\usbhubsvc4\Parameters] 'ServiceDLL' = '%APPDATA%\NTLocalData\msimg32.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\teamviewervpn] 'ImagePath' = 'system32\DRIVERS\teamviewervpn.sys'
[<HKLM>\SYSTEM\ControlSet001\Services\usbhubsvc4] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\usbhubsvc4] 'ImagePath' = '<SYSTEM32>\svchost.exe -k "MsHubSvc4" -svcr "SkypeC0SvcService.exe"'

Malicious functions:

Creates and executes the following:

'%APPDATA%\NTLocalData\svpn.exe' install "%APPDATA%\NTLocalData\TeamViewerVPN.inf" teamviewervpn
'%APPDATA%\NTLocalData\svpn.exe' restart teamviewervpn
'%TEMP%\NS-E8E2R.tmp\NS-CC6FS.tmp' /SL4 $30092 <Full path to file> 4101099 63488 /verysilent /password=Windows
'%APPDATA%\NTLocalData\SkypeC0SvcService.exe'

Executes the following:

'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\svchost.exe' -k "MsHubSvc4" -svcr "SkypeC0SvcService.exe"
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %APPDATA%\NTLocalData\IMG.JPG

Modifies file system:

Creates the following files:

%APPDATA%\NTLocalData\TeamViewer.ini
%APPDATA%\NTLocalData\tv.ini
%APPDATA%\NTLocalData\teamviewervpn.cat
%APPDATA%\NTLocalData\NS-VVKJD.tmp
%APPDATA%\NTLocalData\NS-R9V08.tmp
%APPDATA%\NTLocalData\NS-TJV5N.tmp
%APPDATA%\NTLocalData\teamviewervpn.inf
%WINDIR%\inf\oem3.inf
%WINDIR%\inf\oem3.PNF
<DRIVERS>\SET3.tmp
%APPDATA%\NTLocalData\teamviewervpn.sys
%APPDATA%\NTLocalData\svpn.exe
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
%APPDATA%\NTLocalData\NS-NF8EG.tmp
%APPDATA%\NTLocalData\NS-JAB2G.tmp
%APPDATA%\NTLocalData\NS-K1MJV.tmp
%APPDATA%\NTLocalData\NS-561HI.tmp
%TEMP%\NS-E8E2R.tmp\NS-CC6FS.tmp
%TEMP%\NS-UQCV8.tmp\_shfoldr.dll
%TEMP%\NS-UQCV8.tmp\_iscrypt.dll
%APPDATA%\NTLocalData\NS-PNM4O.tmp
%APPDATA%\NTLocalData\NS-IIGSH.tmp
%APPDATA%\NTLocalData\NS-3JTAS.tmp
%APPDATA%\NTLocalData\NS-TSBBO.tmp
%APPDATA%\NTLocalData\NS-C2R0S.tmp
%APPDATA%\NTLocalData\NS-VTGQP.tmp
%APPDATA%\NTLocalData\NS-Q6OUH.tmp

Sets the 'hidden' attribute to the following files:

%APPDATA%\NTLocalData\SkypeC0SvcService.exe
%APPDATA%\NTLocalData\addons.bac
%APPDATA%\NTLocalData\tvr.cfg
%APPDATA%\NTLocalData\tv.ini
%APPDATA%\NTLocalData\msimg32.dll
%APPDATA%\NTLocalData\teamviewervpn.inf
%APPDATA%\NTLocalData\svpn.exe
%APPDATA%\NTLocalData\teamviewervpn.cat
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
%APPDATA%\NTLocalData\teamviewervpn.sys
%APPDATA%\NTLocalData\tv_w32.exe
%APPDATA%\NTLocalData\tv_x64.exe
%APPDATA%\NTLocalData\TeamViewer_Desktop.exe
%APPDATA%\NTLocalData\TeamViewer_StaticRes.dll
%APPDATA%\NTLocalData\TeamViewer_Resource_en.dll
%APPDATA%\NTLocalData\vpn64.cab
%APPDATA%\NTLocalData\TeamViewer.ini
%APPDATA%\NTLocalData\vpn86.cab
%APPDATA%\NTLocalData\tv_w32.dll
%APPDATA%\NTLocalData\tv_x64.dll

Deletes the following files:

%TEMP%\Cab12.tmp
%TEMP%\Cab14.tmp
%TEMP%\Cab10.tmp
%TEMP%\CabC.tmp
%TEMP%\CabE.tmp
%TEMP%\Cab1C.tmp
%TEMP%\Cab1E.tmp
%TEMP%\Cab1A.tmp
%TEMP%\Cab16.tmp
%TEMP%\Cab18.tmp
%APPDATA%\NTLocalData\teamviewervpn.sys
%APPDATA%\NTLocalData\teamviewervpn.cat
%TEMP%\NS-E8E2R.tmp\NS-CC6FS.tmp
%TEMP%\NS-UQCV8.tmp\_iscrypt.dll
%TEMP%\NS-UQCV8.tmp\_shfoldr.dll
%TEMP%\Cab8.tmp
%TEMP%\CabA.tmp
%TEMP%\Cab6.tmp
%APPDATA%\NTLocalData\teamviewervpn.inf
%TEMP%\Cab4.tmp

Moves the following files:

from %APPDATA%\NTLocalData\NS-NF8EG.tmp to %APPDATA%\NTLocalData\tv_x64.exe
from %APPDATA%\NTLocalData\NS-TSBBO.tmp to %APPDATA%\NTLocalData\tv_x64.dll
from %APPDATA%\NTLocalData\NS-3JTAS.tmp to %APPDATA%\NTLocalData\tv_w32.exe
from %APPDATA%\NTLocalData\NS-VVKJD.tmp to %APPDATA%\NTLocalData\vpn64.cab
from <DRIVERS>\SET3.tmp to <DRIVERS>\teamviewervpn.sys
from %APPDATA%\NTLocalData\NS-TJV5N.tmp to %APPDATA%\NTLocalData\IMG.JPG
from %APPDATA%\NTLocalData\NS-R9V08.tmp to %APPDATA%\NTLocalData\vpn86.cab
from %APPDATA%\NTLocalData\NS-IIGSH.tmp to %APPDATA%\NTLocalData\tv_w32.dll
from %APPDATA%\NTLocalData\NS-561HI.tmp to %APPDATA%\NTLocalData\SkypeC0SvcService.exe
from %APPDATA%\NTLocalData\NS-K1MJV.tmp to %APPDATA%\NTLocalData\msimg32.dll
from %APPDATA%\NTLocalData\NS-JAB2G.tmp to %APPDATA%\NTLocalData\addons.bac
from %APPDATA%\NTLocalData\NS-PNM4O.tmp to %APPDATA%\NTLocalData\TeamViewer_Desktop.exe
from %APPDATA%\NTLocalData\NS-Q6OUH.tmp to %APPDATA%\NTLocalData\tvr.cfg
from %APPDATA%\NTLocalData\NS-VTGQP.tmp to %APPDATA%\NTLocalData\TeamViewer_StaticRes.dll
from %APPDATA%\NTLocalData\NS-C2R0S.tmp to %APPDATA%\NTLocalData\TeamViewer_Resource_en.dll

Network activity:

Connects to:

'www.download.windowsupdate.com':80
'wp#d':80

TCP:

HTTP GET requests:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://11#.#11.111.1/wpad.dat via wp#d

UDP:

DNS ASK www.download.windowsupdate.com
DNS ASK wp#d

Miscellaneous:

Searches for the following windows:

ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial