Trojan.DownLoader25.15013

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4bc266115aa6b0b2abdd4911a539e081' = '"%HOMEPATH%\system32.exe" ..'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '4bc266115aa6b0b2abdd4911a539e081' = '"%HOMEPATH%\system32.exe" ..'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\4bc266115aa6b0b2abdd4911a539e081.exe

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%HOMEPATH%\system32.exe' = '%HOMEPATH%\system32.exe:*:Enabled:system32...

Executes the following:

'%HOMEPATH%\system32.exe'
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%HOMEPATH%\system32.exe" "system32.exe" ENABLE
'C:\6ec8a950b156619e5fcb0e35267360\Setup.exe'
'%ALLUSERSPROFILE%\Application Data\WindowsApplication2\WindowsApplication2\1.0.0.0\temp\ero.exe'
'%ALLUSERSPROFILE%\Application Data\WindowsApplication2\WindowsApplication2\1.0.0.0\temp\sys.exe'

Modifies file system:

Creates the following files:

C:\6ec8a950b156619e5fcb0e35267360\1049\eula.rtf
C:\6ec8a950b156619e5fcb0e35267360\Graphics\Print.ico
C:\6ec8a950b156619e5fcb0e35267360\1049\SetupResources.dll
C:\6ec8a950b156619e5fcb0e35267360\1049\LocalizedData.xml
C:\6ec8a950b156619e5fcb0e35267360\Graphics\Rotate3.ico
C:\6ec8a950b156619e5fcb0e35267360\Graphics\Rotate4.ico
C:\6ec8a950b156619e5fcb0e35267360\Graphics\Rotate1.ico
C:\6ec8a950b156619e5fcb0e35267360\Graphics\Rotate2.ico
C:\6ec8a950b156619e5fcb0e35267360\1031\SetupResources.dll
C:\6ec8a950b156619e5fcb0e35267360\1031\LocalizedData.xml
C:\6ec8a950b156619e5fcb0e35267360\1036\LocalizedData.xml
C:\6ec8a950b156619e5fcb0e35267360\1036\eula.rtf
C:\6ec8a950b156619e5fcb0e35267360\3082\LocalizedData.xml
C:\6ec8a950b156619e5fcb0e35267360\3082\eula.rtf
C:\6ec8a950b156619e5fcb0e35267360\1031\eula.rtf
C:\6ec8a950b156619e5fcb0e35267360\3082\SetupResources.dll
C:\6ec8a950b156619e5fcb0e35267360\Graphics\Rotate5.ico
C:\6ec8a950b156619e5fcb0e35267360\vc_red.msi
C:\6ec8a950b156619e5fcb0e35267360\$shtdwn$.req
C:\6ec8a950b156619e5fcb0e35267360\Graphics\warn.ico
C:\6ec8a950b156619e5fcb0e35267360\vc_red.cab
%TEMP%\Microsoft Visual C++ 2010 x86 Redistributable Setup_20170731_135011687.html
%HOMEPATH%\system32.exe
%TEMP%\HFI2.tmp.html
%TEMP%\Setup_20170731_135010421.html
C:\6ec8a950b156619e5fcb0e35267360\Graphics\Rotate8.ico
C:\6ec8a950b156619e5fcb0e35267360\Graphics\Save.ico
C:\6ec8a950b156619e5fcb0e35267360\Graphics\Rotate6.ico
C:\6ec8a950b156619e5fcb0e35267360\Graphics\Rotate7.ico
C:\6ec8a950b156619e5fcb0e35267360\Graphics\SysReqNotMet.ico
C:\6ec8a950b156619e5fcb0e35267360\Graphics\stop.ico
C:\6ec8a950b156619e5fcb0e35267360\Graphics\Setup.ico
C:\6ec8a950b156619e5fcb0e35267360\Graphics\SysReqMet.ico
C:\6ec8a950b156619e5fcb0e35267360\1036\SetupResources.dll
C:\6ec8a950b156619e5fcb0e35267360\DisplayIcon.ico
C:\6ec8a950b156619e5fcb0e35267360\UiInfo.xml
C:\6ec8a950b156619e5fcb0e35267360\watermark.bmp
C:\6ec8a950b156619e5fcb0e35267360\header.bmp
C:\6ec8a950b156619e5fcb0e35267360\ParameterInfo.xml
C:\6ec8a950b156619e5fcb0e35267360\1033\SetupResources.dll
C:\6ec8a950b156619e5fcb0e35267360\Strings.xml
C:\6ec8a950b156619e5fcb0e35267360\SplashScreen.bmp
C:\6ec8a950b156619e5fcb0e35267360\DHtmlHeader.html
C:\6ec8a950b156619e5fcb0e35267360\Setup.exe
%ALLUSERSPROFILE%\Application Data\WindowsApplication2\WindowsApplication2\1.0.0.0\temp\ero.exe
%ALLUSERSPROFILE%\Application Data\WindowsApplication2\WindowsApplication2\1.0.0.0\temp\sys.exe
C:\6ec8a950b156619e5fcb0e35267360\SetupUi.xsd
C:\6ec8a950b156619e5fcb0e35267360\sqmapi.dll
C:\6ec8a950b156619e5fcb0e35267360\SetupEngine.dll
C:\6ec8a950b156619e5fcb0e35267360\SetupUi.dll
C:\6ec8a950b156619e5fcb0e35267360\1033\LocalizedData.xml
C:\6ec8a950b156619e5fcb0e35267360\2052\SetupResources.dll
C:\6ec8a950b156619e5fcb0e35267360\2052\LocalizedData.xml
C:\6ec8a950b156619e5fcb0e35267360\1028\LocalizedData.xml
C:\6ec8a950b156619e5fcb0e35267360\1028\eula.rtf
C:\6ec8a950b156619e5fcb0e35267360\1040\LocalizedData.xml
C:\6ec8a950b156619e5fcb0e35267360\1040\eula.rtf
C:\6ec8a950b156619e5fcb0e35267360\2052\eula.rtf
C:\6ec8a950b156619e5fcb0e35267360\1040\SetupResources.dll
C:\6ec8a950b156619e5fcb0e35267360\1041\LocalizedData.xml
C:\6ec8a950b156619e5fcb0e35267360\1041\eula.rtf
C:\6ec8a950b156619e5fcb0e35267360\1033\eula.rtf
C:\6ec8a950b156619e5fcb0e35267360\1041\SetupResources.dll
C:\6ec8a950b156619e5fcb0e35267360\1042\eula.rtf
C:\6ec8a950b156619e5fcb0e35267360\1028\SetupResources.dll
C:\6ec8a950b156619e5fcb0e35267360\1042\SetupResources.dll
C:\6ec8a950b156619e5fcb0e35267360\1042\LocalizedData.xml

Moves the following files:

from %TEMP%\Setup_20170731_135010421.html to %TEMP%\Microsoft Visual C++ 2010 x86 Redistributable Setup_20170731_135011687.html
from %TEMP%\HFI2.tmp.html to %TEMP%\Setup_20170731_135010421.html

Network activity:

Connects to: