Trojan.AutoIt.554

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\30000221\wrr.exe %TEMP%\30000221\GOU_XP~1'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%TEMP%\79461246\twq.exe %TEMP%\79461246\IUV_LX~1'

Malicious functions

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe

Terminates or attempts to terminate

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe

Modifies file system

Creates the following files

%TEMP%\30000221\jmu.docx
%TEMP%\79461246\tom.ini
%TEMP%\79461246\fdr.txt
%TEMP%\79461246\upj.xml
%TEMP%\79461246\oiv.ico
%TEMP%\79461246\ptx.ini
%TEMP%\79461246\piu.docx
%TEMP%\79461246\qsj.dll
%TEMP%\79461246\oli.ini
%TEMP%\79461246\gwe.mp3
%TEMP%\79461246\hxv.txt
%TEMP%\79461246\ihr.docx
%TEMP%\79461246\jqn.cpl
%TEMP%\79461246\eib.txt
%TEMP%\79461246\gdn.xml
%TEMP%\79461246\uht.dll
%TEMP%\79461246\uix.txt
%TEMP%\79461246\its.ico
%TEMP%\79461246\uik.bmp
%TEMP%\79461246\jib.dat
%TEMP%\79461246\twq.exe
%TEMP%\79461246\pcw.vbs
%TEMP%\79461246\iuv=lxv
%TEMP%\79461246\oik.log
%TEMP%\30000221\cat.exe
%TEMP%\30000221\ivg.ico
%TEMP%\30000221\ovn.msc
%TEMP%\30000221\jhm.ppt
%TEMP%\30000221\aid.exe
%TEMP%\30000221\ldg.docx
%TEMP%\30000221\qjm.bin
%TEMP%\79461246\qgv.exe
%TEMP%\79461246\mwx.xl
%TEMP%\79461246\jmi.ini
%TEMP%\79461246\mge.bin
%TEMP%\79461246\bdv.msc
%TEMP%\79461246\ndo.docx
%TEMP%\79461246\peb.txt
%TEMP%\79461246\uid.msc
%TEMP%\79461246\gvm.dat
%TEMP%\79461246\jbv.ppt
%TEMP%\79461246\auw.dat
%HOMEPATH%\temp\oik.log
%TEMP%\79461246\pko.msc
%TEMP%\79461246\tek.dat
%TEMP%\79461246\vba.bmp
%TEMP%\79461246\uge.ico
%TEMP%\79461246\doi.ppt
%HOMEPATH%\temp\jmu.docx
%TEMP%\79461246\nlv.ini
%TEMP%\79461246\cma.ini
%TEMP%\79461246\xig.bin
%TEMP%\79461246\jcj.xml
%TEMP%\79461246\mxr.xls
%TEMP%\79461246\cle.xls
%TEMP%\79461246\puk.dat
%TEMP%\79461246\amg.exe
%TEMP%\79461246\luu.log
%TEMP%\79461246\ixm.xl
%TEMP%\79461246\uwq.dll
%TEMP%\79461246\irb.ico
%TEMP%\79461246\kxi.bin
%TEMP%\79461246\icv.dat
%TEMP%\79461246\org.msc
%TEMP%\79461246\xqb.xl
%TEMP%\79461246\qtq.pdf
%TEMP%\30000221\hbn.msc
%TEMP%\79461246\kvo.jpg
%TEMP%\30000221\keu.xl
%TEMP%\30000221\wnq.bin
%TEMP%\30000221\vxl.txt
%TEMP%\30000221\xgx.xl
%TEMP%\30000221\nqv.icm
%TEMP%\30000221\tro.jpg
%TEMP%\30000221\eka.bin
%TEMP%\30000221\qsf.xl
%TEMP%\30000221\evq.bmp
%TEMP%\30000221\tdv.msc
%TEMP%\30000221\qvq.xl
%TEMP%\30000221\mcj.pdf
%TEMP%\30000221\drf.bmp
%TEMP%\30000221\wfe.bmp
%TEMP%\30000221\egw.ini
%TEMP%\30000221\qwq.ini
%TEMP%\30000221\hix.bin
%TEMP%\30000221\wdx.xl
%TEMP%\30000221\cla.icm
%TEMP%\30000221\kvb.jpg
%TEMP%\30000221\wsr.pdf
%TEMP%\30000221\feo.txt
%TEMP%\30000221\fwk.exe
%TEMP%\30000221\icf.docx
%TEMP%\30000221\the.docx
%TEMP%\30000221\hvm.dll
%TEMP%\30000221\oxb.docx
%TEMP%\30000221\nav.xls
%TEMP%\30000221\ngn.xml
%TEMP%\30000221\wrr.exe
%TEMP%\30000221\rie.vbs
%TEMP%\30000221\gou=xpo
%TEMP%\30000221\vwi.exe
%TEMP%\30000221\lsl.exe
%TEMP%\30000221\cqk.bin
%TEMP%\30000221\uco.pdf
%TEMP%\30000221\sbd.msc
%TEMP%\30000221\igm.docx
%TEMP%\30000221\qun.docx
%TEMP%\30000221\chd.bmp
%TEMP%\30000221\rbc.pdf
%TEMP%\30000221\ewq.ico
%TEMP%\30000221\idb.mp3
%TEMP%\30000221\eum.cpl
%TEMP%\30000221\ekk.icm
%TEMP%\30000221\oup.xls
%TEMP%\30000221\fem.icm
%TEMP%\30000221\dql.ppt
%TEMP%\30000221\bsv.xml
%TEMP%\30000221\rnc.xml
%TEMP%\30000221\gfs.xml
%TEMP%\30000221\vqi.dll
%TEMP%\30000221\iau.pdf
%TEMP%\30000221\ebg.ico
%TEMP%\30000221\bbb.jpg
%TEMP%\30000221\nei.bin
%TEMP%\30000221\daf.txt
%TEMP%\30000221\doj.icm
%TEMP%\30000221\qha.xls
%TEMP%\30000221\anj.bin
%TEMP%\30000221\kug.xl
%TEMP%\30000221\usi.ico
%TEMP%\30000221\dxw.docx
%TEMP%\30000221\skr.icm
%TEMP%\30000221\tep.mp3
%TEMP%\30000221\fpj.xml
%TEMP%\30000221\fgm.pdf
%TEMP%\30000221\xlx.exe
%APPDATA%\597d9903-ea81-40e6-803a-40d3e5258fa4\run.dat

Sets the 'hidden' attribute to the following files

%TEMP%\30000221\wrr.exe
%TEMP%\79461246\twq.exe

Network activity

TCP

HTTP GET requests

http://ch#####.amazonaws.com/

UDP

DNS ASK ch#####.amazonaws.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%TEMP%\30000221\cat.exe' ГŸ“Г§’ВЈГ‹ƒГ§˜ВҐГЎВµВ°ГЎˆƒГ¦В¦ВҐГўВќ˜ГЈВўœГ¬ВЈВҐГЄВ¬—Г¦Œ—Г¤ВѕВ«Г®ВЄВЃГЎ‡‘ГЁВ°›ГўВјВ¬Г ВѕšГšВЎГЈВўВ¶ГЎ‰‚Г¤В®ВѕГ¬ВђВГ‡В¤ГЎšВђГ©ВЃВ¦Г©В·ВїГЎВЌŒГўВ¶–Г®ˆ†Гў‚В¶ГЄВ©В»ГЁВ°ВГ¤†ВђГўВЌВЏГЄВґ€Г©‹œГВќ...
'<SYSTEM32>\wscript.exe' "%TEMP%\30000221\rie.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\79461246\pcw.vbs"
'%TEMP%\30000221\wrr.exe' gou=xpo
'%TEMP%\79461246\twq.exe' iuv=lxv

Executes the following