Trojan.DownLoader35.62975

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%WINDIR%\tasks\pptassistantupdatetask_user.job
%WINDIR%\tasks\pptassistantnotifytask_user.job
<SYSTEM32>\tasks\pptassistantnotifytask_user
<SYSTEM32>\tasks\pptassistantupdatetask_user

Modifies file system

Creates the following files

%TEMP%\nsg1d7f.tmp\v6svc_oem.dll
%TEMP%\pptassist\~1022db\meihua.exe
%TEMP%\pptassist\~1022db\notify.exe
%TEMP%\pptassist\~1022db\utility\uninst.exe
%TEMP%\pptassist\~1022db\updateself.exe
%TEMP%\pptassist\~1022db\pptassist.dll
%TEMP%\pptassist\~1022db\pptassist64.dll
%LOCALAPPDATA%\pptassist\assistdownloader.exe
%LOCALAPPDATA%\pptassist\assistupdate.exe
%LOCALAPPDATA%\pptassist\cfgs\feature.dat
%LOCALAPPDATA%\pptassist\cfgs\setup.cfg
%LOCALAPPDATA%\pptassist\desktoptip.exe
%LOCALAPPDATA%\pptassist\meihua2003.pps
%APPDATA%\pptassist\update\log\notify_2020_11_21.log
%LOCALAPPDATA%\pptassist\meihua2007.ppsx
%LOCALAPPDATA%\pptassist\meihua2010.ppsx
%LOCALAPPDATA%\pptassist\meihua2013.ppsx
%LOCALAPPDATA%\pptassist\meihuappt.pps
%LOCALAPPDATA%\pptassist\notify.exe
%LOCALAPPDATA%\pptassist\pptassist.dll
%LOCALAPPDATA%\pptassist\pptassist64.dll
%LOCALAPPDATA%\pptassist\updateself.exe
%LOCALAPPDATA%\pptassist\utility\uninst.exe
%APPDATA%\microsoft\windows\start menu\programs\ppt美化大师\ppt美化大师.lnk
%APPDATA%\microsoft\windows\start menu\programs\ppt美化大师\卸载.lnk
%TEMP%\pptassist\~1022db\desktoptip.exe
%LOCALAPPDATA%\pptassist\meihua.exe
%TEMP%\pptassist\~1022db\assistupdate.exe
%TEMP%\pptassist\~10225e\install_res\20.png
%TEMP%\nsg1d7f.tmp\system.dll
%ALLUSERSPROFILE%\kingsoft\20201121_172938\<File name>.exe
%ALLUSERSPROFILE%\kingsoft\20201121_172938\oem.ini
%TEMP%\pptassist\~10225e\install_res\2.jpg
%TEMP%\pptassist\~10225e\install_res\1.png
%TEMP%\pptassist\~10225e\install_res\10.png
%TEMP%\pptassist\~10225e\install_res\100.png
%TEMP%\pptassist\~10225e\install_res\101.png
%TEMP%\pptassist\~10225e\install_res\102.png
%TEMP%\pptassist\~10225e\install_res\103.png
%TEMP%\pptassist\~10225e\install_res\104.png
%TEMP%\pptassist\~10225e\install_res\3.png
%TEMP%\pptassist\~1022db\meihua2013.ppsx
%TEMP%\pptassist\~10225e\install_res\30.png
%TEMP%\pptassist\~10225e\install_res\cgpb_bg.png
%TEMP%\pptassist\~10225e\install_res\cgpb_fg.png
%TEMP%\pptassist\~10225e\product.xml
%TEMP%\pptassist\~10225e\setup.xml
%TEMP%\pptassist\~1022db\meihua2003.pps
%TEMP%\pptassist\~1022db\meihuappt.pps
%TEMP%\pptassist\~1022db\cfgs\setup.cfg
%TEMP%\pptassist\~1022db\cfgs\feature.dat
%TEMP%\pptassist\~1022db\meihua2007.ppsx
%TEMP%\pptassist\~1022db\meihua2010.ppsx
%TEMP%\pptassist\~1022db\assistdownloader.exe
%TEMP%\nsg1d7f.tmp\findprocdll.dll

Deletes the following files

%TEMP%\pptassist\~1022db\assistdownloader.exe
%TEMP%\nsg1d7f.tmp\findprocdll.dll
%ALLUSERSPROFILE%\kingsoft\20201121_172938\<File name>.exe
%ALLUSERSPROFILE%\kingsoft\20201121_172938\oem.ini
%TEMP%\pptassist\~10225e\product.xml
%TEMP%\pptassist\~10225e\install_res\cgpb_fg.png
%TEMP%\pptassist\~10225e\install_res\cgpb_bg.png
%TEMP%\pptassist\~1022db\utility\uninst.exe
%TEMP%\pptassist\~1022db\updateself.exe
%TEMP%\pptassist\~1022db\pptassist64.dll
%TEMP%\pptassist\~1022db\pptassist.dll
%TEMP%\pptassist\~1022db\notify.exe
%TEMP%\pptassist\~1022db\meihuappt.pps
%TEMP%\pptassist\~1022db\meihua2013.ppsx
%TEMP%\pptassist\~1022db\meihua2010.ppsx
%TEMP%\pptassist\~1022db\meihua2007.ppsx
%TEMP%\pptassist\~1022db\meihua2003.pps
%TEMP%\pptassist\~1022db\meihua.exe
%TEMP%\pptassist\~1022db\desktoptip.exe
%TEMP%\pptassist\~1022db\cfgs\setup.cfg
%TEMP%\pptassist\~1022db\cfgs\feature.dat
%TEMP%\pptassist\~1022db\assistupdate.exe
%TEMP%\nsg1d7f.tmp\system.dll
%TEMP%\nsg1d7f.tmp\v6svc_oem.dll

Network activity

Connects to

'no####.meihua.docer.com':80

TCP

HTTP POST requests

http://sp###.wps.cn/showpro/infos.ads?v=#########################################################################################################################################################...

UDP

DNS ASK sp###.wps.cn
DNS ASK no####.meihua.docer.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'pptassistsetup_message'
ClassName: '' WindowName: 'PPT美化大师安装向导'

Creates and executes the following

'%ALLUSERSPROFILE%\kingsoft\20201121_172938\<File name>.exe'
'%LOCALAPPDATA%\pptassist\assistupdate.exe' -createtask
'%LOCALAPPDATA%\pptassist\notify.exe' /from:ksostart
'%WINDIR%\syswow64\regsvr32.exe' /s "%LOCALAPPDATA%\PPTAssist\pptassist.dll"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "%LOCALAPPDATA%\PPTAssist\pptassist64.dll"' (with hidden window)
'%LOCALAPPDATA%\pptassist\assistupdate.exe' -createtask' (with hidden window)
'%LOCALAPPDATA%\pptassist\notify.exe' /from:ksostart' (with hidden window)

Executes the following