Trojan.DownLoader25.57204

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\skype.callto\shell\open\command] '' = '"%ProgramFiles%\Skype\Phone\Skype.exe" "/callto:%l"'
[<HKLM>\SOFTWARE\Classes\skype\shell\open\command] '' = '"%ProgramFiles%\Skype\Phone\Skype.exe" "/uri:%1"'
[<HKLM>\SOFTWARE\Classes\Skype.Content\shell\open\command] '' = '"%ProgramFiles%\Skype\Phone\Skype.exe" /file:"%1"'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\SkypeUpdate] 'ImagePath' = '"%ProgramFiles%\Skype\Updater\Updater.exe"'
[<HKLM>\SYSTEM\ControlSet001\Services\SkypeUpdate] 'Start' = '00000002'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Skype\Phone\Skype.exe' = '%ProgramFiles%\Skype\Phone\Sk...

Executes the following:

'<SYSTEM32>\msiexec.exe' -Embedding C7B61253A443858117C23491D4F57805 M Global\MSI0000
'<SYSTEM32>\attrib.exe' +r "%ProgramFiles%\Skype"
'<SYSTEM32>\msiexec.exe' -Embedding E9F815571BD0995C5656476AC1DFBBA8
'<SYSTEM32>\msiexec.exe' /i "%CommonProgramFiles%\Setup.msi" /qn STARTSKYPE=FALSE SKYPEREMOVAL=DEFAULT ALLUSERS=1 AUTOUPDATE=0 /norestart
'<SYSTEM32>\msiexec.exe' /V

Modifies file system:

Creates the following files:

%ProgramFiles%\Skype\Updater\Updater.dll
%ProgramFiles%\Skype\third-party_attributions.txt
%ALLUSERSPROFILE%\Desktop\Skype.lnk
%ProgramFiles%\Skype\Updater\Updater.exe
%CommonProgramFiles%\Skype\Skype4COM.dll
%WINDIR%\Installer\MSI10.tmp
%TEMP%\CabE.tmp
%ProgramFiles%\Skype\Phone\Skype.exe
%ProgramFiles%\Skype\Phone\Login.cab
%WINDIR%\Installer\MSI12.tmp
%WINDIR%\Installer\MSI11.tmp
%WINDIR%\Installer\MSI14.tmp
%TEMP%\~DF1F1F.tmp
%WINDIR%\Installer\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}\SkypeIcon.exe
%HOMEPATH%\SendTo\Skype.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Skype\Skype.lnk
%WINDIR%\Installer\261a2.msi
%ProgramFiles%\Skype\desktop.ini
%TEMP%\CabC.tmp
%ALLUSERSPROFILE%\Application Data\Skype\SKY5.tmp
%WINDIR%\Installer\MSI4.tmp
%TEMP%\~DFC6A9.tmp
%WINDIR%\Installer\261a0.ipi
%WINDIR%\Installer\MSI3.tmp
%CommonProgramFiles%\Setup.msi
%TEMP%\aut1.tmp
%WINDIR%\Installer\MSI2.tmp
%WINDIR%\Installer\2619e.msi
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%TEMP%\CabA.tmp
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%WINDIR%\Installer\MSI7.tmp
%WINDIR%\Installer\MSI6.tmp
%WINDIR%\Installer\MSI9.tmp
C:\Config.Msi\261a1.rbs

Sets the 'hidden' attribute to the following files:

Deletes the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl via 20#.#6.232.182
http://11#.#11.111.1/wpad.dat via wp#d
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl via 20#.#6.232.182

UDP: