Trojan.DownLoader24.63810

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\skype\shell\open\command] '' = '"%ProgramFiles%\Skype\Phone\Skype.exe" "/uri:%1"'
[<HKLM>\SOFTWARE\Classes\skype.callto\shell\open\command] '' = '"%ProgramFiles%\Skype\Phone\Skype.exe" "/callto:%l"'
[<HKLM>\SOFTWARE\Classes\Skype.Content\shell\open\command] '' = '"%ProgramFiles%\Skype\Phone\Skype.exe" /file:"%1"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype' = '"%ProgramFiles%\Skype\Phone\Skype.exe" /minimized /regrun'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\SkypeUpdate] 'ImagePath' = '"%ProgramFiles%\Skype\Updater\Updater.exe"'
[<HKLM>\SYSTEM\ControlSet001\Services\SkypeUpdate] 'Start' = '00000002'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Skype\Phone\Skype.exe' = '%ProgramFiles%\Skype\Phone\Sk...

Executes the following:

'<SYSTEM32>\msiexec.exe' -Embedding 866E242ED586C1DB27E9F8C22784548E M Global\MSI0000
'<SYSTEM32>\attrib.exe' +r "%ProgramFiles%\Skype"
'<SYSTEM32>\msiexec.exe' -Embedding 24F3DCB8438581D9DF15A3C11C42FC5F
'<SYSTEM32>\msiexec.exe' /i "%APPDATA%\Setup.msi" /qn STARTSKYPE=FALSE SKYPEREMOVAL=DEFAULT ALLUSERS=1 AUTOUPDATE=0 /norestart
'<SYSTEM32>\msiexec.exe' /V

Modifies file system:

Creates the following files:

%CommonProgramFiles%\Skype\Skype4COM.dll
%ProgramFiles%\Skype\Phone\Skype.exe
%ProgramFiles%\Skype\Browser\SkypeBrowserHost.exe
%ProgramFiles%\Skype\Updater\Updater.dll
%ProgramFiles%\Skype\third-party_attributions.txt
%TEMP%\CabC.tmp
%TEMP%\CabA.tmp
%TEMP%\CabE.tmp
%ProgramFiles%\Skype\Phone\Login.cab
%WINDIR%\Installer\MSI10.tmp
%ProgramFiles%\Skype\Updater\Updater.exe
%WINDIR%\Installer\MSI11.tmp
%WINDIR%\Installer\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}\SkypeIcon.exe
%WINDIR%\Installer\MSI12.tmp
%WINDIR%\Installer\MSI14.tmp
%TEMP%\~DFC4F2.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Skype\Skype.lnk
%ALLUSERSPROFILE%\Desktop\Skype.lnk
%HOMEPATH%\SendTo\Skype.lnk
%WINDIR%\Installer\2a12c.msi
%ProgramFiles%\Skype\desktop.ini
%APPDATA%\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21
%WINDIR%\Installer\MSI2.tmp
%WINDIR%\Installer\MSI4.tmp
%WINDIR%\Installer\MSI3.tmp
%APPDATA%\Setup.msi
%TEMP%\aut1.tmp
%WINDIR%\Installer\2a128.msi
%APPDATA%\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759AD
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759AD
%ALLUSERSPROFILE%\Application Data\Skype\SKY5.tmp
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%WINDIR%\Installer\MSI9.tmp
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%TEMP%\~DF6580.tmp
%WINDIR%\Installer\2a12a.ipi
%WINDIR%\Installer\MSI6.tmp
C:\Config.Msi\2a12b.rbs
%WINDIR%\Installer\MSI7.tmp

Sets the 'hidden' attribute to the following files:

%APPDATA%\Setup.msi

Deletes the following files:

%WINDIR%\Installer\MSI7.tmp
C:\Config.Msi\2a12b.rbs
%WINDIR%\Installer\MSI11.tmp
%WINDIR%\Installer\MSI12.tmp
%ALLUSERSPROFILE%\Application Data\Skype\SKY5.tmp
%WINDIR%\Installer\2a12a.ipi
%APPDATA%\Setup.msi
%WINDIR%\Installer\MSI14.tmp
%WINDIR%\Installer\2a128.msi
%WINDIR%\Installer\MSI10.tmp
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\MSI4.tmp
%TEMP%\aut1.tmp
%WINDIR%\Installer\MSI2.tmp
%WINDIR%\Installer\MSI6.tmp
%TEMP%\CabE.tmp
%WINDIR%\Installer\MSI9.tmp
%TEMP%\CabA.tmp
%TEMP%\CabC.tmp

Network activity:

Connects to:

'www.download.windowsupdate.com':80
'20#.#6.232.182':80
'wp#d':80

TCP:

HTTP GET requests:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl via 20#.#6.232.182
http://11#.#11.111.1/wpad.dat via wp#d
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl via 20#.#6.232.182

UDP: