Trojan.DownLoader23.51473

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\At7.job
%WINDIR%\Tasks\At6.job
%WINDIR%\Tasks\At9.job
%WINDIR%\Tasks\At8.job
%WINDIR%\Tasks\At5.job
%WINDIR%\Tasks\At2.job
%WINDIR%\Tasks\At1.job
%WINDIR%\Tasks\At4.job
%WINDIR%\Tasks\At3.job

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Executes the following:

'<SYSTEM32>\at.exe' 10:41 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%CommonProgramFiles%\Microsoft Shared\Speech\sapisvrs.exe"
'<SYSTEM32>\at.exe' 6:32 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%ProgramFiles%\Internet Explorer\iexplorer.exe"
'<SYSTEM32>\cmd.exe' /c copy "%APPDATA%\microsoft\installer\{caf09671-e1ba-4d99-b6ef-912562bf8086}\ieinstaller.exe" "%CommonProgramFiles%\Microsoft Shared\Speech\sapisvrs.exe"
'<SYSTEM32>\at.exe' 8:39 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32s.exe"
'<SYSTEM32>\at.exe' 3:34 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%ProgramFiles%\FireFox\update.exe"
'%TEMP%\updatems.exe' /n
'<SYSTEM32>\at.exe' 6:37 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%TEMP%\updatems.exe"
'<SYSTEM32>\at.exe' 6:30 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%TEMP%\updatems.exe"
'<SYSTEM32>\cmd.exe' /c copy "%APPDATA%\microsoft\installer\{caf09671-e1ba-4d99-b6ef-912562bf8086}\ieinstaller.exe" "%ProgramFiles%\Movie Maker\moviemks.exe"
'<SYSTEM32>\at.exe' 12:43 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%ProgramFiles%\Movie Maker\moviemks.exe"
'<SYSTEM32>\reg.exe' add hklm\software\microsoft\windows\currentversion\policies\system /v consentpromptbehavioradmin /t reg_dword /d 0 /f
'<SYSTEM32>\cmd.exe' /c copy "%APPDATA%\microsoft\installer\{caf09671-e1ba-4d99-b6ef-912562bf8086}\ieinstaller.exe" "%APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstallers.exe"
'<SYSTEM32>\reg.exe' add hklm\software\microsoft\windows\currentversion\policies\system /v enablelua /t reg_dword /d 0x0 /f
'%APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstaller.exe'
'%TEMP%\fourthofjulyss.exe'
'<SYSTEM32>\at.exe' 5:36 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%CommonProgramFiles%\Microsoft Shared\DW\DW20s.exe"
'<SYSTEM32>\cmd.exe' /c copy "%APPDATA%\microsoft\installer\{caf09671-e1ba-4d99-b6ef-912562bf8086}\ieinstaller.exe" "%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32s.exe"
'%TEMP%\fourthofjulyss.exe' /wrapper /dir="%TEMP%\pkg_625b1e40" /pproc="<File name>.exe"
'<SYSTEM32>\at.exe' 6:37 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "%APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstallers.exe"
'<SYSTEM32>\cmd.exe' /c copy "%APPDATA%\microsoft\installer\{caf09671-e1ba-4d99-b6ef-912562bf8086}\ieinstaller.exe" "%CommonProgramFiles%\Microsoft Shared\DW\DW20s.exe"

Installs hooks to intercept notifications

on keystrokes:

Handler for the 'fourthofjulyss.exe' process: <SYSTEM32>\w1sv32e.dll

Modifies file system:

Creates the following files:

%TEMP%\pkg_625b1e40\detectionrules.dat
%ProgramFiles%\Internet Explorer\iexplorer.exe
%CommonProgramFiles%\Microsoft Shared\Speech\sapisvrs.exe
%ProgramFiles%\FireFox\update.exe
%ProgramFiles%\FireFox\RCX1.tmp
<SYSTEM32>\w1sv32e.dll
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\configpublic96[1].dat
%TEMP%\updatems.exe
%ProgramFiles%\Internet Explorer\RCX2.tmp
%ProgramFiles%\Movie Maker\moviemks.exe
%TEMP%\pkg_625b1e40\wrapper.xml
%TEMP%\pkg_625b1e40\autorun.txt
%TEMP%\pkg_625b1e40\stub.log
%APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstaller.exe
%TEMP%\fourthofjulyss.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32s.exe
%TEMP%\pkg_625b1e40\fourthofjulyss.log
%CommonProgramFiles%\Microsoft Shared\DW\DW20s.exe
%APPDATA%\Microsoft\Installer\{CAF09671-E1BA-4D99-B6EF-912562BF8086}\ieinstallers.exe
%TEMP%\pkg_625b1e40\timings.txt

Deletes the following files:

%ProgramFiles%\Internet Explorer\iexplorer.exe
%ProgramFiles%\FireFox\update.exe

Network activity:

Connects to:

'ma###.#0freehost.com':80
'sq####0.tripod.com':80
'na#####ammed.tripod.com':80
'localhost':1035
'dl.###talliq.com':80

TCP:

HTTP GET requests:

http://ma###.#0freehost.com/configpublic96.dat
http://sq####0.tripod.com/configpublic96.dat
http://dl.###talliq.com/api/detectionrequest.aspx?ke############################################
http://na#####ammed.tripod.com/configpublic96.dat

UDP: