Trojan.DownLoader33.5397

Technical Information

Malicious functions

Modifies settings of Windows Internet Explorer

[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = ''
[<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '127.0.0.1'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonZoneCrossing' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPostRedirect' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnonBadCertRecving' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPost' = '{00,00,00,00}'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1601' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1601' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1601' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1601' = '00000000'

Modifies file system

Creates the following files

%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\virtual\sxs\manifests\cafw.exe_0xaad55bb5a414930cd725d65224f50ef9.1.manifest
%TEMP%\rese27.tmp
%TEMP%\csce26.tmp
%TEMP%\fu8xlacj.out
%TEMP%\fu8xlacj.cmdline
%TEMP%\fu8xlacj.0.cs
%TEMP%\5_wajuw7.dll
%TEMP%\resfd2f.tmp
%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\cvtres.exe
%TEMP%\cscfd2e.tmp
%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\csc.exe
%TEMP%\5_wajuw7.out
%TEMP%\5_wajuw7.cmdline
%TEMP%\5_wajuw7.0.cs
%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\virtual\sxs\myapplication.app@1.0.0.0\myapplication.app@1.0.0.0.manifest
%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\virtual\sxs\myapplication.app@1.0.0.0\myapplication.app.manifest
%TEMP%\fu8xlacj.dll
%PROGRAMDATA%\cladgenius.com\cladgenius\logs\cafw.log

Deletes the following files

%TEMP%\resfd2f.tmp
%TEMP%\cscfd2e.tmp
%TEMP%\5_wajuw7.out
%TEMP%\5_wajuw7.cmdline
%TEMP%\5_wajuw7.dll
%TEMP%\5_wajuw7.0.cs
%TEMP%\rese27.tmp
%TEMP%\csce26.tmp
%TEMP%\fu8xlacj.0.cs
%TEMP%\fu8xlacj.dll
%TEMP%\fu8xlacj.cmdline
%TEMP%\fu8xlacj.out

Network activity

Connects to

'94.##9.77.62':80

UDP

'94.##9.77.62':8752
'94.##9.66.191':8752
'83.##2.48.27':8752
'20#.#4.240.76':8752
'91.##4.44.122':8752

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5_wajuw7.cmdline"
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFD2F.tmp" "%TEMP%\CSCFD2E.tmp"
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fu8xlacj.cmdline"
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE27.tmp" "%TEMP%\CSCE26.tmp"
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5_wajuw7.cmdline"' (with hidden window)
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFD2F.tmp" "%TEMP%\CSCFD2E.tmp"' (with hidden window)
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fu8xlacj.cmdline"' (with hidden window)
'%TEMP%\xenocode\sandbox\cladgenius\1.0.0.0\native\stubexe\8.0.1135\@windir@\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE27.tmp" "%TEMP%\CSCE26.tmp"' (with hidden window)

Executes the following